A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263),…

published 2022-09-13 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-41701

cvss: 7.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 17%
public exploits: 0; none known

A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Parasolid V35.0 (All versions >= V35.0.161 < V35.0.164), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The affected application is vulnerable to out of bounds read past the end of an allocated buffer when parsing X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-18196)

Patch / fix

fixed in 2

siemens simcenter_femap 2022.1.3, 2022.2.2
siemens parasolid 33.1.262, 34.0.252, 34.1.242, 35.0.164

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-22-258-02 updated 2022-09-13 cvss 7.8

Siemens Simcenter Femap and Parasolid

Siemens Parasolid V33.1 <V33.1.262, >=V33.1.262_<V33.1.263
affected: fixed in V33.1.262, mitigation support.sw.siemens.com
Siemens Parasolid V34.0 <V34.0.252
affected: fixed in V34.0.252, mitigation support.sw.siemens.com
Siemens Parasolid V34.1 <V34.1.242
affected: fixed in V34.1.242, mitigation support.sw.siemens.com
Siemens Parasolid V35.0 <V35.0.161, >=V35.0.161_<V35.0.164
affected: fixed in V35.0.161, mitigation support.sw.siemens.com
Siemens Simcenter Femap V2022.1 <V2022.1.3
affected: fixed in V2022.1.3, mitigation support.sw.siemens.com
Siemens Simcenter Femap V2022.2 <V2022.2.2
affected: fixed in V2022.2.2, mitigation support.sw.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

0.26% chance of exploitation in the next 30 days, higher than 17% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Siemens Parasolid V33.1
Siemens Parasolid V34.0
Siemens Parasolid V34.1
Siemens Parasolid V35.0
Siemens Simcenter Femap V2022.1
Siemens Simcenter Femap V2022.2

Classification

Weakness

CWE-125 Out-of-bounds Read

References

cert-portal.siemens.com /productcert/pdf/ssa-518824.pdf
vendor-advisory

Sources

CVE List CVE-2022-39156
NVD CVE-2022-39156

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary