CVE-2026-64629: Siemens Parasolid X_T Out-of-Bounds Read — Detection and Remediation Guide for Engineering Workstations

---
title: CAD Application Spawning Suspicious Child Process
tid: 8f2c4a91-3d6e-4b1a-9c7d-2e5f8a1b3c4d
status: experimental
description: Detects CAD/engineering applications (Parasolid-based and similar) spawning shells, script interpreters, or LOLBins — a strong indicator of successful file-parsing exploit execution such as CVE-2026-64629 delivered via a malicious X_T file.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-10-0
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/08/14
tags:
  - attack.execution
  - attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\solidedge.exe'
      - '\ugraf.exe'
      - '\nx.exe'
      - '\siemensnx.exe'
      - '\onshape.exe'
      - '\mastercam.exe'
      - '\solidworks.exe'
      - '\sldworks.exe'
      - '\fusion360.exe'
      - '\adcx.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare CAD macro or automation integrations launching scripts — validate against engineering team workflows before tuning
level: high
---
title: X_T Parasolid File Downloaded from Internet Zone
tid: 3b7e1f42-8a5c-4d29-b6e1-9f4c7d2a8e5b
status: experimental
description: Detects Mark-of-the-Web tagged X_T (Parasolid transmit) files written to disk, indicating delivery via browser or email — the primary delivery vector for CVE-2026-64629 exploitation attempts against engineering users.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-10-0
  - https://attack.mitre.org/techniques/T1566/
author: Security Arsenal
date: 2026/08/14
tags:
  - attack.initial_access
  - attack.t1566.001
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith:
      - '.x_t:Zone.Identifier'
      - '.x_b:Zone.Identifier'
  filter_paths:
    TargetFilename|contains:
      - '\ProgramData\Siemens\'
      - '\\corp_share\'
  condition: selection and not filter_paths
falsepositives:
  - Legitimate engineering file downloads from supplier portals — high volume expected; use for triage context and correlation with child-process alerts rather than standalone blocking
level: low
---
title: Unexpected Crash of CAD Application Process
tid: 5d9a3e18-6c4b-4f72-a1d8-7b3e9c2f4a6d
status: experimental
description: Detects Windows Error Reporting events for CAD/engineering applications, which may indicate attempted exploitation of the Parasolid X_T out-of-bounds read (CVE-2026-64629) causing application crashes.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-10-0
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/08/14
tags:
  - attack.execution
  - attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\werfault.exe'
      - '\wermgr.exe'
    CommandLine|contains:
      - 'solidedge'
      - 'ugraf'
      - 'sldworks'
      - 'mastercam'
      - 'fusion360'
  condition: selection
falsepositives:
  - Legitimate application instability on engineering workstations — CAD crashes are common; correlate with recent X_T file opens and MOTW events to elevate fidelity
level: medium

// Hunt: CAD application child process or crash correlated with recent X_T file activity
let CadApps = dynamic(["solidedge.exe","ugraf.exe","nx.exe","sldworks.exe","solidworks.exe","mastercam.exe","fusion360.exe","onshape.exe"]);
let SuspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","certutil.exe","bitsadmin.exe"]);
let XtFiles =
    DeviceFileEvents
    | where TimeGenerated > ago(7d)
    | where FileName endswith ".x_t" or FileName endswith ".x_b"
    | project XtTime = TimeGenerated, DeviceId, DeviceName, XtPath = FolderPath;
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any (CadApps)
| where FileName has_any (SuspiciousChildren)
| project ProcTime = TimeGenerated, DeviceId, DeviceName,
          CadProcess = InitiatingProcessFileName,
          ChildProcess = FileName, ChildCmdLine = ProcessCommandLine,
          AccountName
| join kind=inner XtFiles on DeviceId
| where ProcTime between (XtTime .. XtTime + 10m)
| project DeviceName, XtPath, XtTime, CadProcess, ChildProcess, ChildCmdLine, AccountName, ProcTime
| order by ProcTime desc;

// Companion query: application error events for CAD processes (crash telemetry via Defender)
DeviceEvents
| where TimeGenerated > ago(7d)
| where ActionType == "AppCrash" or ActionType contains "Error"
| where FileName has_any (dynamic(["solidedge.exe","ugraf.exe","nx.exe","sldworks.exe","mastercam.exe","fusion360.exe"]))
| summarize CrashCount = count(), FirstCrash = min(TimeGenerated), LastCrash = max(TimeGenerated) by DeviceName, FileName
| order by CrashCount desc;

-- Hunt: X_T/X_B files with Mark-of-the-Web (internet-delivered Parasolid files)
SELECT FullPath AS XtFile,
       parse_pe(file=FullPath + ':Zone.Identifier') AS ZoneData,
       Mtime AS ModifiedTime,
       Size AS FileSize
FROM glob(globs='C:/Users/*/**/*.x_t:Zone.Identifier')

-- Hunt: Active CAD/engineering processes with command lines and owners
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(solidedge|ugraf|sldworks|solidworks|mastercam|fusion360|nx\.exe)'

# CVE-2026-64629 - Siemens Parasolid X_T Out-of-Bounds Read - Verification Script
# Run as Administrator on engineering workstations

$Report = @()

# 1. Enumerate installed Siemens / Parasolid-based products
$Installed = Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*,
             HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName -match 'Parasolid|Siemens|Solid Edge|NX' } |
    Select-Object DisplayName, DisplayVersion, InstallDate

foreach ($app in $Installed) {
    $Report += [PSCustomObject]@{
        Check = 'InstalledProduct'
        Detail = "$($app.DisplayName) - $($app.DisplayVersion)"
        Vulnerable = if ($app.DisplayVersion -match '^38\.0\.' -and [version]($app.DisplayVersion -replace '[^0-9\.]','') -lt [version]'38.0.235') { 'YES - PATCH REQUIRED' }
                     elseif ($app.DisplayVersion -match '^38\.1\.' -and [version]($app.DisplayVersion -replace '[^0-9\.]','') -lt [version]'38.1.230') { 'YES - PATCH REQUIRED' }
                     else { 'Review against vendor advisory' }
    }
}

# 2. Search for Parasolid kernel DLLs (pskernel.dll) and check versions
$KernelDlls = Get-ChildItem -Path 'C:\Program Files','C:\Program Files (x86)' -Recurse -Filter 'pskernel.dll' -ErrorAction SilentlyContinue
foreach ($dll in $KernelDlls) {
    $ver = [version]$dll.VersionInfo.ProductVersion
    $vuln = ($ver.Major -eq 38 -and $ver.Minor -eq 0 -and $ver -lt [version]'38.0.235') -or
            ($ver.Major -eq 38 -and $ver.Minor -eq 1 -and $ver -lt [version]'38.1.230')
    $Report += [PSCustomObject]@{
        Check = 'ParasolidKernelDLL'
        Detail = "$($dll.FullName) - Version $ver"
        Vulnerable = if ($vuln) { 'YES - CVE-2026-64629 - PATCH REQUIRED' } else { 'No' }
    }
}

# 3. Flag recently downloaded X_T files (potential staging artifacts)
$XtFiles = Get-ChildItem -Path 'C:\Users\*\Downloads','C:\Users\*\Desktop' -Recurse -Include '*.x_t','*.x_b' -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) }
foreach ($f in $XtFiles) {
    $zone = Get-Content -Path "$($f.FullName):Zone.Identifier" -ErrorAction SilentlyContinue
    $Report += [PSCustomObject]@{
        Check = 'StagedXtFile'
        Detail = "$($f.FullName) - LastWrite $($f.LastWriteTime) - MOTW: $(if($zone){'Yes'}else{'No'})"
        Vulnerable = 'N/A - Review provenance'
    }
}

$Report | Format-Table -AutoSize
$Report | Export-Csv -Path "$env:TEMP\CVE-2026-64629_Assessment.csv" -NoTypeInformation
Write-Host "`nAssessment complete. Report saved to $env:TEMP\CVE-2026-64629_Assessment.csv" -ForegroundColor Cyan