CVE-2023-49125: High XT File Out-of-bounds Read in Siemens Parasolid

CVE-2023-49125 is a high severity (CVSS 7.8) out-of-bounds read in Siemens Parasolid and Solid Edge, triggered when the application reads a crafted XT format file. A user must open the file. Siemens lists fixed builds for each branch, so update and avoid opening untrusted XT files.

What's affected

• Parasolid V35.0 before V35.0.263, V35.1 before V35.1.252 and V36.0 before V36.0.198, per Siemens advisory SSA-797296 of 13 February 2024.
• Solid Edge SE2023 before V223.0 Update 11 and Solid Edge SE2024 before V224.0 Update 3, per Siemens advisory SSA-382651, first published 12 March 2024.
• Fix: update to the first fixed build named above, or a later one. Siemens points to its support site for the downloads.
• Workaround from Siemens: do not open untrusted XT files in the affected applications.
• Parasolid is a geometry kernel that other products embed, so check for other software of yours that bundles it.
• Severity: the record gives CVSS 7.8, which is high. KEV status: the record shows kev as false, and none of the sources we read report exploitation in the wild.

The CVSS 3.1 vector in the record is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Read plainly, it describes an attack with local access, with low attack complexity, requiring no privileges and a user action such as opening a file or clicking a link. Impact on confidentiality is high, on integrity high and on availability high. The scope is unchanged, so the impact stays within the vulnerable component.

How to check if you're exposed

Start with a list of software that uses Parasolid or Solid Edge. Parasolid is a modelling component that other vendors include in their own products, so the vendor of those products may need to confirm which Parasolid build they ship.

For Solid Edge, find the version and update level on each workstation and compare it with the numbers above. For software that embeds Parasolid, ask the supplier whether it contains a build below the fixed version for its branch.

Then find who opens XT files. The XT format is a Parasolid transmit format, commonly exchanged between systems. Check where files in this format arrive from.

What to do now

1. Update Parasolid to V35.0.263, V35.1.252 or V36.0.198 or later, matching your branch.
2. Update Solid Edge SE2023 to V223.0 Update 11 or later, and SE2024 to V224.0 Update 3 or later.
3. Do not open untrusted XT files until you have updated.
4. Ask suppliers of software that embeds Parasolid whether they ship a fixed build.
5. Run engineering applications as a standard user, so any code that runs has limited rights.

Why it matters

The class is CWE-125 (Out-of-bounds Read). The program reads memory past the end of a structure it allocated while parsing a crafted XT file. Siemens describes the result as possible code execution in the context of the current process. Reads past a buffer can reveal data or cause crashes, and in some cases can be combined with other behaviour to gain control.

The interesting part for defenders is the supply chain. A flaw in a shared geometry kernel reaches every product that embeds it, and each vendor has to ship its own update. That is why one CVE appears in two Siemens advisories with different fixed builds. Your inventory needs to list components inside products, not just the products.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Siemens advisory SSA-797296, Parasolid
• Siemens advisory SSA-382651, Solid Edge

Last reviewed: 19 October 2026.