CISA republishes Siemens advisory on Parasolid flaw and fix

By Atlas Watchline Staff · Regulatory · August 13, 2026

CISA republished a Siemens advisory warning that a Parasolid out-of-bounds read flaw could crash affected applications or allow code execution. Siemens has issued fixed versions.

Siemens said a vulnerability in Parasolid, its geometric modeling kernel, could let an attacker crash affected applications or run code. CISA republished the advisory on Aug. 13, 2026.

The advisory says the flaw can be triggered by specially crafted X_T-format files. In affected systems, that could lead to an out-of-bounds read and, in some cases, code execution in the context of the current process.

CISA identified the weakness as CWE-125, or out-of-bounds read. Its advisory says Siemens released fixed versions and recommends updating to the latest releases. The listed remediation targets are V38.0.235 or later and V38.1.230 or later.

The republished advisory says it is a verbatim copy of Siemens ProductCERT SSA-138516 from a CSAF advisory. CISA says it does not warrant the accuracy of the republished content. The source text also points users to Siemens ProductCERT contact information and terms-of-use references.

Siemens advises users to protect network access to devices with appropriate mechanisms, follow Siemens industrial security operational guidelines and use product manuals. CISA separately repeats its standard guidance for control system operators: minimize network exposure, keep devices and systems off the internet, place control networks and remote devices behind firewalls, separate them from business networks, and use VPNs for remote access when needed.

CISA also says organizations should update VPNs to the latest available version and carry out impact analysis and risk assessment before deploying defensive measures. The agency says suspected malicious activity should be reported to CISA.

The source text adds that CISA recently updated its anonymous product survey and welcomes feedback, but that note is separate from the vulnerability advisory.

Users of affected Siemens software are directed to install the fixed versions and review network protections before continuing to process X_T files.

Sources

• CISA advisory page

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.

This is the AMP version of the article. Read the full article on Atlas Watchline.