CVE-2026-42478 Details
Description
An issue was discovered in VrmlData_IndexedFaceSet::TShape in the VRML V2.0 parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 allows attackers to cause a denial of service via a crafted VRML file. The issue occurs because malformed VRML input can trigger dereference of a corrupt or unvalidated pointer during shape construction in libTKDEVRML.so.
A memory safety vulnerability allowing for out-of-bounds reads has been identified in the VRML V2.0 parser of Open CASCADE Technology (OCCT) versions through 7.8.1 and the master branch prior to commit c540f316. The issue arises in the 'libTKDEVRML.so' component, specifically within the 'VrmlData_IndexedFaceSet::TShape' function. Attackers can exploit this vulnerability by crafting a VRML file that triggers the dereference of a corrupt or unvalidated pointer during shape construction, leading to a denial-of-service condition.
Users are advised to update to the latest version of Open CASCADE Technology, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/sgInnora/dfba083d04906283e9c92aea78e2d94a | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
| CWE-125 | Out-of-bounds Read | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| opencascade open cascade technology | <= 7.9.3 8.0.0 beta1 8.0.0 rc1 8.0.0 rc2 8.0.0 rc3 8.0.0 rc4 8.0.0 rc5 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 1, 2026 | CVE Modified | CISA-ADP |
| May 1, 2026 | Initial Analysis | [email protected] |
| May 1, 2026 | New CVE Received | [email protected] |