CVE-2026-42477
HighSummary
CVE-2026-42477 describes a heap-based out-of-bounds read vulnerability in the RWObj_Reader::read function in the OBJ file parser in Open CASCADE Technology (OCCT) V8_0_0_rc5. This vulnerability can be exploited by user-assisted attackers persuading a victim to open a crafted OBJ file, potentially leading to denial of service or exposure of sensitive information.
Risk Assessment
Organizations may be at risk of attacks that lead to denial of service or data leakage, impacting the integrity and confidentiality of information.
Recommendation
It is recommended to update to the latest version of Open CASCADE Technology to mitigate this vulnerability and implement safeguards against opening unknown OBJ files.
Other vulnerabilities in Open CASCADE Technology (OCCT) V8_0_0_rc5
See all- CVE-2026-42478High
An issue was discovered in the VRML V2.0 parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 that allows attackers to cause a denial of service via a crafted VRML file. The issue occurs because malformed VRML input can trigger dereference of a corrupt or unvalidated pointer during shape construction.
- CVE-2026-42476High
Two heap-based out-of-bounds read vulnerabilities exist in the STL ASCII file parser in Open CASCADE Technology (OCCT) V8_0_0_rc5. These issues arise from improper length validation of buffers before data access, potentially leading to denial of service or information disclosure.
Original NVD description (English source)
A heap-based out-of-bounds read vulnerability in RWObj_Reader::read in the OBJ file parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 allows user-assisted attackers to cause a denial of service or obtain sensitive information by persuading a victim to open a crafted OBJ file. The issue occurs because Standard_ReadLineBuffer::ReadLine() can return a 1-byte buffer for a minimal OBJ line, and RWObj_Reader::read() calls pushIndices(aLine + 2) without validating the buffer length.