Out-of-bounds write in Siemens Parasolid V35.1
Priority LOW 36CWE-787Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.
Summary
A vulnerability has been identified in Parasolid V35.1 (All versions < V35.1.256), Parasolid V36.0 (All versions < V36.0.210), Parasolid V36.1 (All versions < V36.1.185). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted X_T part file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-23468)
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00305 23rd percentileScored 2026-11-07
Fix Fixed Parasolid V35.1 (Siemens): V35.1.256Parasolid V36.0 (Siemens): V36.0.210+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | Parasolid V35.1 | before V35.1.256 | V35.1.256 | Patch available | CNA |
| Siemens | Parasolid V36.0 | before V36.0.210 | V36.0.210 | Patch available | CNA |
| Siemens | Parasolid V36.1 | before V36.1.185 | V36.1.185 | Patch available | CNA |
- Parasolid V35.1 VendorSiemens Affected before V35.1.256 Fixed in V35.1.256 Patch available CNA
- Parasolid V36.0 VendorSiemens Affected before V36.0.210 Fixed in V36.0.210 Patch available CNA
- Parasolid V36.1 VendorSiemens Affected before V36.1.185 Fixed in V36.1.185 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:siemens:parasolid:*:*:*:*:*:*:*:* | 35.1 to before 35.1.256; 36.0 to before 36.0.210; 36.1 to before 36.1.185 | Vulnerable | Siemens |
- cpe:2.3:a:siemens:parasolid:*:*:*:*:*:*:*:* Versions 35.1 to before 35.1.256; 36.0 to before 36.0.210; 36.1 to before 36.1.185 Vulnerable ·Siemens
Remediation
- Fix · CNA Parasolid V35.1 (Siemens) Fixed in V35.1.256
- Fix · CNA Parasolid V36.0 (Siemens) Fixed in V36.0.210
- Fix · CNA Parasolid V36.1 (Siemens) Fixed in V36.1.185
Timeline
- 2026-10-02 Threatist record created from CVE-2024-31980
- 2026-10-03 Alias added: GHSA-7rmp-9hrq-f45x
References
More Siemens Parasolid vulnerabilities
- TI-2022-22893 Out-of-bounds read in Siemens Parasolid V33.1 CVSS 3.1HIGH 7.8
- TI-2022-22891 Out-of-bounds write in Siemens Parasolid V33.1 CVSS 3.1HIGH 7.8
- TI-2023-24404 Stack-based buffer overflow in Siemens Parasolid V35.0 CVSS 3.1HIGH 7.8
- TI-2023-21659 Out-of-bounds write in Siemens Parasolid V34.1 CVSS 3.1HIGH 7.8
- TI-2022-22892 Out-of-bounds write in Siemens Parasolid V33.1 CVSS 3.1HIGH 7.8
- TI-2022-22889 Out-of-bounds write in Siemens Parasolid V33.1 CVSS 3.1HIGH 7.8
Sources
- CVE-2024-31980 · CVE Program
- CVE-2024-31980 · NVD
- FIRST EPSS
- GHSA-7rmp-9hrq-f45x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences