CVE-2026-42477

What it is

A heap-based out-of-bounds read vulnerability in RWObj_Reader::read in the OBJ file parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 allows user-assisted attackers to cause a denial of service or obtain sensitive information by persuading a victim to open a crafted OBJ file. The issue occurs because Standard_ReadLineBuffer::ReadLine() can return a 1-byte buffer for a minimal OBJ line, and RWObj_Reader::read() calls pushIndices(aLine + 2) without validating the buffer length.

At a glance

Exploitability

Can be exploited locally on the machine without logging in, but needs a user to act. High risk of data exposure, service disruption.

Exploit odds

0.1% chance of exploitation in the next 30 days (EPSS).

Fix

No patch or advisory is linked yet. Look at mitigations or restrict exposure.

Timeline

1. 2026-05-01 15:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-06-17 10:47 UTC Last updatedMost recent change to the record

Details

Published

2026-05-01 15:16 UTC

Last modified

2026-06-17 10:47 UTC

Exploit probability

0.1% · EPSS, next 30 days

Weakness

CWE-125 · Out-of-bounds read

Record status

Modified

Affected

• Opencascade Open Cascade Technology ≤ 7.9.3
• Opencascade Open Cascade Technology 8.0.0

Attack profile CVSS 3.1 · 7.1

Attack vector

Local

Complexity

Low

Privileges needed

None

User interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High