Open CASCADE Technology (OCCT) V8_0_0_rc5 vulnerabilities

An issue was discovered in the VRML V2.0 parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 that allows attackers to cause a denial of service via a crafted VRML file. The issue occurs because malformed VRML input can trigger dereference of a corrupt or unvalidated pointer during shape construction.

CVE-2026-42477 describes a heap-based out-of-bounds read vulnerability in the RWObj_Reader::read function in the OBJ file parser in Open CASCADE Technology (OCCT) V8_0_0_rc5. This vulnerability can be exploited by user-assisted attackers persuading a victim to open a crafted OBJ file, potentially leading to denial of service or exposure of sensitive information.

Two heap-based out-of-bounds read vulnerabilities exist in the STL ASCII file parser in Open CASCADE Technology (OCCT) V8_0_0_rc5. These issues arise from improper length validation of buffers before data access, potentially leading to denial of service or information disclosure.