Two heap-based out-of-bounds read vulnerabilities in the STL ASCII file parser in Open…
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Two heap-based out-of-bounds read vulnerabilities in the STL ASCII file parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 exist in RWStl_Reader::ReadAscii because buffers returned by Standard_ReadLineBuffer::ReadLine() are not properly length-validated before strncasecmp or direct byte access. User-assisted attackers can trigger these issues by persuading a victim to open a crafted STL file with extremely short lines, resulting in a denial of service or possible information disclosure.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:opencascade:open_cascade_technology:*:*:*:*:*:*:*:* | up to 7.9.3 | Vulnerable | Opencascade |
| cpe:2.3:a:opencascade:open_cascade_technology:8.0.0:beta1:*:*:*:*:*:* | 8.0.0 beta1 | Vulnerable | Opencascade |
| cpe:2.3:a:opencascade:open_cascade_technology:8.0.0:rc1:*:*:*:*:*:* | 8.0.0 rc1 | Vulnerable | Opencascade |
| cpe:2.3:a:opencascade:open_cascade_technology:8.0.0:rc2:*:*:*:*:*:* | 8.0.0 rc2 | Vulnerable | Opencascade |
| cpe:2.3:a:opencascade:open_cascade_technology:8.0.0:rc3:*:*:*:*:*:* | 8.0.0 rc3 | Vulnerable | Opencascade |
| cpe:2.3:a:opencascade:open_cascade_technology:8.0.0:rc4:*:*:*:*:*:* | 8.0.0 rc4 | Vulnerable | Opencascade |
| cpe:2.3:a:opencascade:open_cascade_technology:8.0.0:rc5:*:*:*:*:*:* | 8.0.0 rc5 | Vulnerable | Opencascade |
- cpe:2.3:a:opencascade:open_cascade_technology:*:*:*:*:*:*:*:* Versions up to 7.9.3 Vulnerable ·Opencascade
- cpe:2.3:a:opencascade:open_cascade_technology:8.0.0:beta1:*:*:*:*:*:* Versions 8.0.0 beta1 Vulnerable ·Opencascade
- cpe:2.3:a:opencascade:open_cascade_technology:8.0.0:rc1:*:*:*:*:*:* Versions 8.0.0 rc1 Vulnerable ·Opencascade
- cpe:2.3:a:opencascade:open_cascade_technology:8.0.0:rc2:*:*:*:*:*:* Versions 8.0.0 rc2 Vulnerable ·Opencascade
- cpe:2.3:a:opencascade:open_cascade_technology:8.0.0:rc3:*:*:*:*:*:* Versions 8.0.0 rc3 Vulnerable ·Opencascade
- cpe:2.3:a:opencascade:open_cascade_technology:8.0.0:rc4:*:*:*:*:*:* Versions 8.0.0 rc4 Vulnerable ·Opencascade
- cpe:2.3:a:opencascade:open_cascade_technology:8.0.0:rc5:*:*:*:*:*:* Versions 8.0.0 rc5 Vulnerable ·Opencascade
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-42476
- 2026-10-03 Alias added: GHSA-8gr4-rxj5-hxc5
References
More Opencascade Open Cascade Technology vulnerabilities
- TI-2026-30762 An issue was discovered in VrmlData_IndexedFaceSet::TShape in the VRML V2.0 parser in… CVSS 3.1HIGH 7.5
- TI-2026-30761 A heap-based out-of-bounds read vulnerability in RWObj_Reader::read in the OBJ file… CVSS 3.1HIGH 7.1
- TI-2026-30765 Open CASCADE Technology (OCCT) V8_0_0_rc5 contains multiple vulnerabilities in its IGES… CVSS 3.1MEDIUM 5.5
- TI-2026-30764 A stack-based out-of-bounds read vulnerability in VrmlData_Scene::ReadLine in the VRML… CVSS 3.1MEDIUM 5.5
- TI-2026-30763 An out-of-bounds read vulnerability in VrmlData_IndexedLineSet::TShape in the VRML parser… CVSS 3.1MEDIUM 5.5
Sources
- CVE-2026-42476 · CVE Program
- CVE-2026-42476 · NVD
- FIRST EPSS
- GHSA-8gr4-rxj5-hxc5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences