CVE-2026-42478

Published: May 1, 2026Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

An issue was discovered in VrmlData_IndexedFaceSet::TShape in the VRML V2.0 parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 allows attackers to cause a denial of service via a crafted VRML file. The issue occurs because malformed VRML input can trigger dereference of a corrupt or unvalidated pointer during shape construction in libTKDEVRML.so.

Affected (7)

Products: Opencascade: Open Cascade Technology

Opencascade

1 product

Open Cascade Technology

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Opencascade Open Cascade Technology	version ≤ 7.9.3
Opencascade Open Cascade Technology	Version 8.0.0 beta1
Opencascade Open Cascade Technology	Version 8.0.0 rc1
Opencascade Open Cascade Technology	Version 8.0.0 rc2
Opencascade Open Cascade Technology	Version 8.0.0 rc3
Opencascade Open Cascade Technology	Version 8.0.0 rc4
Opencascade Open Cascade Technology	Version 8.0.0 rc5

Related CWEs

CWE-125

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

CWE-476

NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

References (1)

https://gist.github.com/sgInnora/dfba083d04906283e9c92aea78e2d94a

Source: cve@mitre.org

Third Party Advisory

Timeline

No history available yet.