Dashboard / CVE-2026-42477

CVE-2026-42477

HIGH
MEDIUM Priority: 0.01 BB Relevance: 39/100
Published: 2026-05-01 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Low Complexity No Auth Conf. Impact

CVSS Vector Breakdown

AV: Local
AC: Low
PR: None
UI: Required
S: Unchanged
C: High
I: None
A: High

Description

A heap-based out-of-bounds read vulnerability in RWObj_Reader::read in the OBJ file parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 allows user-assisted attackers to cause a denial of service or obtain sensitive information by persuading a victim to open a crafted OBJ file. The issue occurs because Standard_ReadLineBuffer::ReadLine() can return a 1-byte buffer for a minimal OBJ line, and RWObj_Reader::read() calls pushIndices(aLine + 2) without validating the buffer length.

Weakness Classification (2)

Affected Software (7)

VendorProductVersion
opencascade open_cascade_technology < 7.9.3
opencascade open_cascade_technology 8.0.0
opencascade open_cascade_technology 8.0.0
opencascade open_cascade_technology 8.0.0
opencascade open_cascade_technology 8.0.0
opencascade open_cascade_technology 8.0.0
opencascade open_cascade_technology 8.0.0

References & Advisories (1)

Bug Bounty Relevance

39 / 100
✓ No authentication
✓ Low complexity

CVSS Score

7.1 / 10.0 v3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

EPSS — Exploitation Probability

0.10%
Raw Score 0.001040
Percentile 1.0%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00104
2026-11-12
0.00104
2026-11-10
0.00104
2026-11-09
0.00104
2026-11-08
0.00104

Intelligence Sources

nvd ref →

External Links