Executive brief
Parasolid is a CAD geometry modeling engine used in design and manufacturing software. An out-of-bounds read vulnerability in its X_T file parser could allow an attacker who crafts a malicious file to crash the application or execute arbitrary code when the file is opened. This poses a risk to engineering teams and product development workflows that rely on this software.
Technical details
The vulnerability is an out-of-bounds read (CWE-125) in Parasolid's X_T file parsing logic. When the application processes specially crafted X_T geometry files, it reads memory beyond the intended buffer boundaries. The attack vector is local and requires user interaction—a victim must open a malicious X_T file. An attacker can achieve code execution in the context of the Parasolid process, leading to potential data theft, system compromise, or denial of service. Siemens has released patched versions: V38.0.235 and V38.1.230 or later.
Affected products
- Siemens Parasolid V38.0 versions before V38.0.235; V38.1 versions before V38.1.230
Timeline
- 2026-08-11: disclosed