Siemens Parasolid

An attacker could trick a user into opening a malicious X_T file, causing the Parasolid application to crash (denial of service) or potentially allowing arbitrary code execution in the user's process context. If Parasolid is used to control or validate designs for critical infrastructure systems, this could disrupt engineering workflows or compromise design data integrity.

Design and engineering teams using Parasolid for 3D CAD modeling and product design—including mechanical design, architecture, and infrastructure design environments. Any organization using Parasolid V35.1 (before 35.1.256), V36.0 (before 36.0.208), or V36.1 (before 36.1.173) is affected. Critical for water authorities and utilities if Parasolid is used for infrastructure component design or validation.

An attacker creates a malicious X_T (Parasolid model) file containing crafted data that triggers an out-of-bounds read or null pointer dereference. The attacker sends or hosts this file (via email, web link, file share) and tricks an engineer into opening it in Parasolid. The vulnerable parser processes the malicious data, causing a crash or executing arbitrary code in the context of the engineering workstation.