CVE-2026-64629

CVE-2026-64629 is an out-of-bounds read in the Parasolid X_T parser, affecting versions prior to V38.1.230. While CVSS 7.8 frames this as a file-opening user-interaction vulnerability, that scoring severely understates the real-world exposure in industrial environments. The critical insight is the version gap itself. Both V38.0 and V38.1 required independent patches for similar out-of-bounds read vulnerabilities. This pattern reveals more than technical debt—it indicates the V38.0 remediation addressed a specific instance without correcting the architectural class of vulnerability. The parser contains divergent code paths across entity types where security boundaries weren't consistently enforced, meaning sibling vulnerabilities emerged independently through separate release cycles. The next patch cycle will likely reveal more of the same unless the root cause class has been addressed. More importantly, the user-interaction framing assumes a security-conscious recipient. X_T files aren't suspicious attachments—they're engineering deliverables that flow routinely through industrial supply chains between partners, vendors, and customers. The 'user interaction' in this context is opening a file from a primary business partner, not clicking a suspicious attachment. The social context actively discourages suspicion. The downstream blast radius compounds this. Parasolid is embedded in dozens of CAD applications (Siemens NX, Solid Edge, and others). A CAD workstation isn't a general-purpose machine patched on a standard IT schedule—version changes require regression testing of established engineering workflows. The effective patch timeline in risk-averse industrial environments is measured in quarters, not days. Users who patched V38.0 on schedule remained vulnerable through V38.1 until the second disclosure, creating sequential exposure windows that a single-CVE frame misses. Treat this as a supply chain vulnerability, not just a parser bug. Verify which Parasolid version your CAD tools embed, confirm the specific patch level (V38.1.230 or later), and recognize that upstream patch adoption by your downstream CAD vendor may lag significantly behind the Parasolid release date. In industrial environments where X_T files move between organizations without sandboxing, assume the file format is an active attack vector and instrument accordingly.

Reviewed through automated stages and approved by a human before publication.