CVE-2026-42476
Two heap-based out-of-bounds read vulnerabilities in the STL ASCII file parser in Open CASCADE...
Two heap-based out-of-bounds read vulnerabilities in the STL ASCII file parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 exist in RWStl_Reader::ReadAscii because buffers returned by Standard_ReadLineBuffer::ReadLine() are not properly length-validated before strncasecmp or direct byte access. User-assisted attackers can trigger these issues by persuading a victim to open a crafted STL file with extremely short lines, resulting in a denial of service or possible information disclosure.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Two heap-based out-of-bounds read vulnerabilities in the STL ASCII file parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 exist in RWStl_Reader::ReadAscii because buffers returned by Standard_ReadLineBuffer::ReadLine() are not properly length-validated before strncasecmp or direct byte access. User-assisted attackers can trigger these issues by persuading a victim to open a crafted STL file with extremely short lines, resulting in a denial of service or possible information disclosure.
- Record
CVE-2026-42476- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List
Two heap-based out-of-bounds read vulnerabilities in the STL ASCII file parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 exist in RWStl_Reader::ReadAscii because buffers returned by Standard_ReadLineBuffer::ReadLine() are not properly length-validated before strncasecmp or direct byte access. User-assisted attackers can trigger these issues by persuading a victim to open a crafted STL file with extremely short lines, resulting in a denial of service or possible information disclosure.
- Record
CVE-2026-42476- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
EUVDEUVD-2026-26599
Two heap-based out-of-bounds read vulnerabilities in the STL ASCII file parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 exist in RWStl_Reader::ReadAscii because buffers returned by Standard_ReadLineBuffer::ReadLine() are not properly length-validated before strncasecmp or direct byte access. User-assisted attackers can trigger these issues by persuading a victim to open a crafted STL file with extremely short lines, resulting in a denial of service or possible information disclosure.
- Record
EUVD-2026-26599- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8gr4-rxj5-hxc5
Two heap-based out-of-bounds read vulnerabilities in the STL ASCII file parser in Open CASCADE...
Two heap-based out-of-bounds read vulnerabilities in the STL ASCII file parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 exist in RWStl_Reader::ReadAscii because buffers returned by Standard_ReadLineBuffer::ReadLine() are not properly length-validated before strncasecmp or direct byte access. User-assisted attackers can trigger these issues by persuading a victim to open a crafted STL file with extremely short lines, resulting in a denial of service or possible information disclosure.
- Record
GHSA-8gr4-rxj5-hxc5- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSV
Two heap-based out-of-bounds read vulnerabilities in the STL ASCII file parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 exist in RWStl_Reader::ReadAscii because buffers returned by Standard_ReadLineBuffer::ReadLine() are not properly length-validated before strncasecmp or direct byte access. User-assisted attackers can trigger these issues by persuading a victim to open a crafted STL file with extremely short lines, resulting in a denial of service or possible information disclosure.
- Record
CVE-2026-42476- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-42476
Two heap-based out-of-bounds read vulnerabilities in the STL ASCII file parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 exist in RWStl_Reader::ReadAscii because buffers returned by Standard_ReadLineBuffer::ReadLine() are not properly length-validated before strncasecmp or direct byte access. User-assisted attackers can trigger these issues by persuading a victim to open a crafted STL file with extremely short lines, resulting in a denial of service or possible information disclosure.
- Record
DEBIAN-CVE-2026-42476- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-42476
Two heap-based out-of-bounds read vulnerabilities in the STL ASCII file parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 exist in RWStl_Reader::ReadAscii because buffers returned by Standard_ReadLineBuffer::ReadLine() are not properly length-validated before strncasecmp or direct byte access. User-assisted attackers can trigger these issues by persuading a victim to open a crafted STL file with extremely short lines, resulting in a denial of service or possible information disclosure.
- Record
UBUNTU-CVE-2026-42476- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
opencascadeDebian:12 |
All versions, plus listed versions 7.6.3+dfsg1-77.6.3+dfsg1-7.17.7.1+dfsg1-1~exp17.7.1+dfsg1-1~exp27.8.1+dfsg1-1 Show 14 moreShow less7.8.1+dfsg1-1~exp17.8.1+dfsg1-27.8.1+dfsg1-37.8.1+dfsg1-4~exp17.8.1+dfsg1-57.8.1+dfsg1-67.8.1+dfsg1-77.9.1+dfsg-1~exp17.9.1+dfsg-1~exp27.9.2+dfsg-17.9.2+dfsg-27.9.2+dfsg-37.9.2+dfsg-47.9.2+dfsg-5 |
None known |
opencascadeDebian:13 |
All versions, plus listed versions 7.8.1+dfsg1-37.8.1+dfsg1-4~exp17.8.1+dfsg1-57.8.1+dfsg1-67.8.1+dfsg1-7 Show 7 moreShow less7.9.1+dfsg-1~exp17.9.1+dfsg-1~exp27.9.2+dfsg-17.9.2+dfsg-27.9.2+dfsg-37.9.2+dfsg-47.9.2+dfsg-5 |
None known |
opencascadeDebian:14 |
All versions, plus listed versions 7.8.1+dfsg1-37.8.1+dfsg1-4~exp17.8.1+dfsg1-57.8.1+dfsg1-67.8.1+dfsg1-7 Show 7 moreShow less7.9.1+dfsg-1~exp17.9.1+dfsg-1~exp27.9.2+dfsg-17.9.2+dfsg-27.9.2+dfsg-37.9.2+dfsg-47.9.2+dfsg-5 |
None known |
opencascadeUbuntu:20.04:LTS |
All versions, plus listed versions 7.3.3+dfsg1-17.3.3+dfsg1-1build1 |
None known |
opencascadeUbuntu:22.04:LTS |
All versions, plus listed versions 7.5.1+dfsg1-27.5.1+dfsg1-2ubuntu1 |
None known |
opencascadeUbuntu:24.04:LTS |
All versions, plus listed versions 7.6.3+dfsg1-77.6.3+dfsg1-7.17.6.3+dfsg1-7.1build1 |
None known |
opencascadeUbuntu:25.10 |
All versions, plus listed versions 7.8.1+dfsg1-3 |
None known |
opencascadeUbuntu:26.10 |
All versions, plus listed versions 7.9.2+dfsg-47.9.2+dfsg-4build1 |
None known |
opencascadeUbuntu:26.04:LTS |
All versions, plus listed versions 7.8.1+dfsg1-37.9.2+dfsg-27.9.2+dfsg-37.9.2+dfsg-4 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-42476 is a high vulnerability (CVSS 7.1) in Opencascade Open Cascade Technology, published May 1, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.11%, the 1st percentile. No source names a fixed version.
References
gist.github.com/sgInnora/dfba083d04906283e9c92aea78e2d94a
nvd.nist.gov/vuln/detail/CVE-2026-42476
github.com/advisories/GHSA-8gr4-rxj5-hxc5
security-tracker.debian.org/tracker/CVE-2026-42476
ubuntu.com/security/CVE-2026-42476
cve.org/CVERecord?id=CVE-2026-42476