Siemens' Parasolid, the geometry engine baked into a wide swath of CAD software, has a bug that can crash the program or let an attacker run their own code.
Siemens disclosed the bug, tracked as CVE-2026-64629, as an out-of-bounds read that triggers when Parasolid parses a specially crafted X_T file. The flaw affects Parasolid V38.0 before version 235 and V38.1 before version 230. It carries a CVSS score of 7.8, rated high severity, and requires a user to open the malicious file rather than any remote, click-free exploit. Siemens has already shipped fixed builds - V38.0.235 and V38.1.230 - and is telling customers to update.
Parasolid is not a niche tool. It is the modeling kernel underneath a long list of CAD products used across the critical manufacturing sector worldwide, which means this is less about one app and more about a shared piece of plumbing. A single rigged design file, passed around the way engineering teams pass around design files every day, is enough to turn a workstation into an entry point.
Old trick, still works: no exotic zero-day chain needed, just a file someone was willing to open.