


Perceptive Security
SOC/SIEM Consultancy

A heap-based out-of-bounds read vulnerability in RWObj_Reader::read in the OBJ file parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 allows user-assisted att…
Published:
30 April 2026 at 22:00:00
Alert date:
1 May 2026 at 20:05:47
Source:
nvd.nist.gov
Enterprise Applications
A heap-based out-of-bounds read vulnerability affects Open CASCADE Technology (OCCT) V8_0_0_rc5 in the OBJ file parser component RWObj_Reader::read. The vulnerability allows user-assisted attackers to cause denial of service or obtain sensitive information by convincing victims to open specially crafted OBJ files. The issue stems from improper buffer length validation where Standard_ReadLineBuffer::ReadLine() can return a 1-byte buffer but RWObj_Reader::read() calls pushIndices(aLine + 2) without checking buffer boundaries. This creates a memory safety issue that could lead to information disclosure or system crashes.
Technical details
Mitigation steps:
Affected products:
Open CASCADE Technology (OCCT)
Related links:
https://nvd.nist.gov/vuln/detail/CVE-2026-42477
https://gist.github.com/sgInnora/dfba083d04906283e9c92aea78e2d94a
Related CVE's:
Related threat actors:
IOC's:
This article was created with the assistance of AI technology by Perceptive.
