VYPR
← All advisories
High severity7.1NVD Advisory· Published May 1, 2026· Updated May 10, 2026

CVE-2026-42477

CVE-2026-42477

Description

A heap-based out-of-bounds read vulnerability in RWObj_Reader::read in the OBJ file parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 allows user-assisted attackers to cause a denial of service or obtain sensitive information by persuading a victim to open a crafted OBJ file. The issue occurs because Standard_ReadLineBuffer::ReadLine() can return a 1-byte buffer for a minimal OBJ line, and RWObj_Reader::read() calls pushIndices(aLine + 2) without validating the buffer length.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

8
  • Opencascade/Open Cascade Technology8 versions
    cpe:2.3:a:opencascade:open_cascade_technology:*:*:*:*:*:*:*:*+ 7 more
    • cpe:2.3:a:opencascade:open_cascade_technology:*:*:*:*:*:*:*:*range: <=7.9.3
    • cpe:2.3:a:opencascade:open_cascade_technology:8.0.0:beta1:*:*:*:*:*:*
    • cpe:2.3:a:opencascade:open_cascade_technology:8.0.0:rc1:*:*:*:*:*:*
    • cpe:2.3:a:opencascade:open_cascade_technology:8.0.0:rc2:*:*:*:*:*:*
    • cpe:2.3:a:opencascade:open_cascade_technology:8.0.0:rc3:*:*:*:*:*:*
    • cpe:2.3:a:opencascade:open_cascade_technology:8.0.0:rc4:*:*:*:*:*:*
    • cpe:2.3:a:opencascade:open_cascade_technology:8.0.0:rc5:*:*:*:*:*:*
    • (no CPE)range: = V8_0_0_rc5

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.