CVE-2026-42478
HighSummary
An issue was discovered in the VRML V2.0 parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 that allows attackers to cause a denial of service via a crafted VRML file. The issue occurs because malformed VRML input can trigger dereference of a corrupt or unvalidated pointer during shape construction.
Risk Assessment
Organizations may be exposed to attacks that lead to denial of service, potentially disrupting the operation of applications using this technology. Possible consequences include loss of service availability and impact on the company's reputation.
Recommendation
It is recommended to update to the latest version of Open CASCADE Technology to mitigate this vulnerability. Additionally, implement validation mechanisms for VRML files before processing them.
Other vulnerabilities in Open CASCADE Technology (OCCT) V8_0_0_rc5
See all- CVE-2026-42477High
CVE-2026-42477 describes a heap-based out-of-bounds read vulnerability in the RWObj_Reader::read function in the OBJ file parser in Open CASCADE Technology (OCCT) V8_0_0_rc5. This vulnerability can be exploited by user-assisted attackers persuading a victim to open a crafted OBJ file, potentially leading to denial of service or exposure of sensitive information.
- CVE-2026-42476High
Two heap-based out-of-bounds read vulnerabilities exist in the STL ASCII file parser in Open CASCADE Technology (OCCT) V8_0_0_rc5. These issues arise from improper length validation of buffers before data access, potentially leading to denial of service or information disclosure.
Original NVD description (English source)
An issue was discovered in VrmlData_IndexedFaceSet::TShape in the VRML V2.0 parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 allows attackers to cause a denial of service via a crafted VRML file. The issue occurs because malformed VRML input can trigger dereference of a corrupt or unvalidated pointer during shape construction in libTKDEVRML.so.