PatchTheCVECVE-2026-42479: An out-of-bounds read vulnerability in VrmlData_IndexedLineSet::TShape in the VRML parser in Open CASCADE Tech
CVE-2026-42479 is a medium-severity flaw (CVSS 5.5) affecting open cascade technology. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An out-of-bounds read vulnerability in VrmlData_IndexedLineSet::TShape in the VRML parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 allows attackers to cause a denial of service via a crafted VRML file. The issue occurs because coordIndex values from parsed input are used as direct array indices without validation against the size of the coordinate array during geometry processing.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.5 (Medium) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 0.1% (top 99%) |
| CISA exploited list | No |
| Weakness | CWE-125 |
| Published | 2026-05-01 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-42479?
open cascade technology: upgrade to newer than 7.9.3. Exact commands for each OS are on this page.
Is CVE-2026-42479 being exploited?
CVE-2026-42479 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-42479 affect?
CVE-2026-42479 affects open cascade technology. Severity is medium (CVSS 5.5). An out-of-bounds read vulnerability in VrmlData_IndexedLineSet::TShape in the VRML parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 allows attackers to cause a denial of service via a crafted VRML file. The issue occurs because coordInde
How urgent is CVE-2026-42479?
Priority 19/100. No elevated risk signals yet.
Related CVEs
- CVE-2026-42481 MEDIUM 5.5 UPGRADE Open CASCADE Technology (OCCT) V8_0_0_rc5 contains multiple vulnerabilities in its IGES and STEP file parsers
- CVE-2026-42480 MEDIUM 5.5 UPGRADE A stack-based out-of-bounds read vulnerability in VrmlData_Scene::ReadLine in the VRML parser in Open CASCADE
- CVE-2026-42478 HIGH 7.5 UPGRADE An issue was discovered in VrmlData_IndexedFaceSet::TShape in the VRML V2.0 parser in Open CASCADE Technology
- CVE-2026-42477 HIGH 7.1 UPGRADE A heap-based out-of-bounds read vulnerability in RWObj_Reader::read in the OBJ file parser in Open CASCADE Tec
- CVE-2026-42476 HIGH 7.1 UPGRADE Two heap-based out-of-bounds read vulnerabilities in the STL ASCII file parser in Open CASCADE Technology (OCC