CISA republishes Siemens Parasolid advisory after out-of-bounds read warning

CISA republished Siemens ProductCERT’s advisory on Siemens Parasolid on Aug. 13, warning that a specially crafted X_T file could trigger an out-of-bounds read in affected versions.

CISA said the issue affects Siemens Parasolid versions V38.0 before V38.0.235 and V38.1 before V38.1.230. The advisory identifies the flaw as CVE-2026-64629 and maps it to CWE-125, or out-of-bounds read.

The agency listed a CVSS v3.1 base score of 7.8 and described the severity as high. It said the attack vector is local, with low attack complexity, no privileges required and user interaction required.

The advisory says an attacker who can trigger the flaw may be able to crash the application or execute code in the context of the current process. CISA said Siemens ProductCERT reported the issue.

Parasolid is used in critical manufacturing, according to the advisory, and the listed deployment area is worldwide.

CISA’s advisory republishes Siemens ProductCERT advisory SSA-138516. The revision history in the notice lists an initial release date of Aug. 11 and a CISA republication date of Aug. 13.

Siemens recommends updating to V38.0.235 or later for the V38.0 line, or V38.1.230 or later for the V38.1 line. CISA also said users should protect network access, follow Siemens industrial security guidance and use CISA recommended ICS practices.

What happens next

Users running affected versions can review Siemens’ support page and apply the listed updates. CISA’s advisory does not add further technical detail beyond the affected versions, remediation versions and general defensive guidance.

Sources

• CISA Cybersecurity Advisories — ICS Advisory ICSA-26-225-10-0

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.