CVE-2026-64629 in Parasolid
Summary
by MITRE • 08/11/2026
A vulnerability has been identified in Parasolid V38.0 (All versions < V38.0.235), Parasolid V38.1 (All versions < V38.1.230). The affected applications contains an out of bounds read vulnerability while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability resides within Parasolid geometry kernel software versions 38.0 through 38.1, specifically affecting all builds prior to 38.0.235 and 38.1.230 respectively. The flaw manifests as an out-of-bounds read condition during the parsing of X_T files, which are commonly used for CAD data exchange in engineering and manufacturing applications. When an attacker crafts a malicious X_T file and feeds it to an affected application, the software's parser fails to properly validate array bounds during file processing, leading to memory access violations that can be exploited for arbitrary code execution. This represents a critical security weakness that directly impacts the integrity of the affected systems.
The technical nature of this vulnerability aligns with CWE-125 Out-of-Bounds Read, which is classified as a memory safety error in the Common Weakness Enumeration catalog. The flaw operates at the boundary between legitimate file parsing operations and malicious input manipulation, where the software's failure to validate input parameters creates an execution path that can be controlled by adversaries. During normal operation, Parasolid processes X_T files containing geometric data structures, but when encountering malformed arrays or insufficiently validated buffer sizes, the parser attempts to read memory locations beyond allocated boundaries.
The operational impact of this vulnerability extends across numerous engineering and design applications that rely on Parasolid for 3D modeling capabilities, including computer-aided design software, product lifecycle management systems, and manufacturing automation platforms. Attackers could leverage this weakness by delivering malicious X_T files through social engineering campaigns, compromised software updates, or direct file transfers to execute arbitrary code within the context of the running application process. This privilege escalation capability allows attackers to potentially gain full control over the affected system, leading to data exfiltration, persistent backdoor installation, or further network compromise.
Mitigation strategies should focus on immediate patch deployment for all affected Parasolid versions, implementing strict file validation protocols before processing any external X_T files, and establishing network-based restrictions on file type handling. Organizations should also consider deploying application whitelisting measures to prevent execution of unauthorized software and implement network segmentation to limit lateral movement capabilities. The vulnerability demonstrates the critical importance of input validation in geometry processing libraries and highlights how seemingly benign file format parsing can become a vector for sophisticated attacks. Security teams must prioritize this issue alongside other memory corruption vulnerabilities and ensure comprehensive testing of all third-party components that handle external data inputs, particularly within industrial control systems where such software components are prevalent.