CVE-2026-64629

HighCVSS 7.8/10Last modified Nov 10, 2026

Description

A vulnerability has been identified in Parasolid V38.0 (All versions < V38.0.235), Parasolid V38.1 (All versions < V38.1.230), Simcenter Femap (All versions < V2606.0002). The affected applications contains an out of bounds read vulnerability while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-125

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Siemens	Parasolid V38.0	< V38.0.235
Siemens	Parasolid V38.1	< V38.1.230

References

https://cert-portal.siemens.com/productcert/html/ssa-138516.html

Timeline

Published: Aug 11, 2026
Last modified: Nov 10, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-646305.3A vulnerability allowing a low-privileged user to retrieve report data outside the scope of a shared report link.CVE-2026-646318.6A vulnerability allowing a low-privileged user to inject SQL and extract database contents.CVE-2026-646328.5A vulnerability allowing a low-privileged user to capture the NTLM credentials of the Reporter service account.CVE-2026-6463310.0A vulnerability allowing remote unauthenticated code execution on the agent host.CVE-2026-646348.4A vulnerability allowing local privilege escalation to the Reporter service context.CVE-2026-646355.3Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated att CVE-2026-646367.7An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data fro CVE-2026-646379.9Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative sessi CVE-2026-646388.9WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party webs CVE-2026-646399.3Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (customer, reseller) to CVE-2026-64648.1Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via er CVE-2026-646406.5Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with