Read the docs
TI-2022-18543 Aliases CVE-2022-39155GHSA-6h9x-pcw3-h5wp

Out-of-bounds write in Siemens Parasolid V33.1

Priority LOW 34CWE-787Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Parasolid V35.0 (All versions >= V35.0.161 < V35.0.164), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The affected application contains an out of bounds write past the end of an allocated buffer while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-18192)

Why it matters now

EPSS 0.00256 17th percentileScored 2026-11-07
Fix Fixed Parasolid V33.1 (Siemens): V33.1.262Parasolid V34.0 (Siemens): V34.0.252+4 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensParasolid V33.1before V33.1.262V33.1.262Patch availableCNA
SiemensParasolid V33.1All versions >= V33.1.262 < V33.1.263—No fix listedCNA
SiemensParasolid V34.0before V34.0.252V34.0.252Patch availableCNA
SiemensParasolid V34.1before V34.1.242V34.1.242Patch availableCNA
SiemensParasolid V35.0before V35.0.161V35.0.161Patch availableCNA
SiemensParasolid V35.0All versions >= V35.0.161 < V35.0.164—No fix listedCNA
SiemensSimcenter Femap V2022.1before V2022.1.3V2022.1.3Patch availableCNA
SiemensSimcenter Femap V2022.2before V2022.2.2V2022.2.2Patch availableCNA
  • Parasolid V33.1 VendorSiemens Affected before V33.1.262 Fixed in V33.1.262 Patch available CNA
  • Parasolid V33.1 VendorSiemens Affected All versions >= V33.1.262 < V33.1.263 Fixed in — No fix listed CNA
  • Parasolid V34.0 VendorSiemens Affected before V34.0.252 Fixed in V34.0.252 Patch available CNA
  • Parasolid V34.1 VendorSiemens Affected before V34.1.242 Fixed in V34.1.242 Patch available CNA
  • Parasolid V35.0 VendorSiemens Affected before V35.0.161 Fixed in V35.0.161 Patch available CNA
  • Parasolid V35.0 VendorSiemens Affected All versions >= V35.0.161 < V35.0.164 Fixed in — No fix listed CNA
  • Simcenter Femap V2022.1 VendorSiemens Affected before V2022.1.3 Fixed in V2022.1.3 Patch available CNA
  • Simcenter Femap V2022.2 VendorSiemens Affected before V2022.2.2 Fixed in V2022.2.2 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:siemens:simcenter_femap:*:*:*:*:*:*:*:*2022.1 to before 2022.1.3; 2022.2 to before 2022.2.2VulnerableSiemens
cpe:2.3:a:siemens:parasolid:*:*:*:*:*:*:*:*33.1 to before 33.1.263; 34.0 to before 34.0.252; 34.1 to before 34.1.242; 35.0 to before 35.0.164VulnerableSiemens
  • cpe:2.3:a:siemens:simcenter_femap:*:*:*:*:*:*:*:* Versions 2022.1 to before 2022.1.3; 2022.2 to before 2022.2.2 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:parasolid:*:*:*:*:*:*:*:* Versions 33.1 to before 33.1.263; 34.0 to before 34.0.252; 34.1 to before 34.1.242; 35.0 to before 35.0.164 Vulnerable ·Siemens

Remediation

  • Fix · CNA Parasolid V33.1 (Siemens) Fixed in V33.1.262
  • Fix · CNA Parasolid V34.0 (Siemens) Fixed in V34.0.252
  • Fix · CNA Parasolid V34.1 (Siemens) Fixed in V34.1.242
  • Fix · CNA Parasolid V35.0 (Siemens) Fixed in V35.0.161
  • Fix · CNA Simcenter Femap V2022.1 (Siemens) Fixed in V2022.1.3
  • Fix · CNA Simcenter Femap V2022.2 (Siemens) Fixed in V2022.2.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-39155
  2. 2026-10-03 Alias added: GHSA-6h9x-pcw3-h5wp

References

Advisory 1

  • TI-2022-22893 Out-of-bounds read in Siemens Parasolid V33.1 CVSS 3.1HIGH 7.8
  • TI-2022-22891 Out-of-bounds write in Siemens Parasolid V33.1 CVSS 3.1HIGH 7.8
  • TI-2024-21079 Out-of-bounds write in Siemens Parasolid V35.1 CVSS 3.1HIGH 7.8
  • TI-2023-24404 Stack-based buffer overflow in Siemens Parasolid V35.0 CVSS 3.1HIGH 7.8
  • TI-2023-21659 Out-of-bounds write in Siemens Parasolid V34.1 CVSS 3.1HIGH 7.8
  • TI-2022-22892 Out-of-bounds write in Siemens Parasolid V33.1 CVSS 3.1HIGH 7.8
See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences