PatchTheCVECVE-2026-42480: A stack-based out-of-bounds read vulnerability in VrmlData_Scene::ReadLine in the VRML parser in Open CASCADE
CVE-2026-42480 is a medium-severity flaw (CVSS 5.5) affecting open cascade technology. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A stack-based out-of-bounds read vulnerability in VrmlData_Scene::ReadLine in the VRML parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 allows attackers to cause a denial of service via a crafted VRML file. The issue occurs because the quoted-string escape handler uses ptr[++anOffset] without proper bounds checking, which can read past the end of a fixed-size stack buffer.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.5 (Medium) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.1% (top 99%) |
| CISA exploited list | No |
| Weakness | CWE-125 |
| Published | 2026-05-01 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-42480?
open cascade technology: upgrade to newer than 7.9.3. Exact commands for each OS are on this page.
Is CVE-2026-42480 being exploited?
CVE-2026-42480 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-42480 affect?
CVE-2026-42480 affects open cascade technology. Severity is medium (CVSS 5.5). A stack-based out-of-bounds read vulnerability in VrmlData_Scene::ReadLine in the VRML parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 allows attackers to cause a denial of service via a crafted VRML file. The issue occurs because the q
How urgent is CVE-2026-42480?
Priority 19/100. No elevated risk signals yet.
Related CVEs
- CVE-2026-42481 MEDIUM 5.5 UPGRADE Open CASCADE Technology (OCCT) V8_0_0_rc5 contains multiple vulnerabilities in its IGES and STEP file parsers
- CVE-2026-42479 MEDIUM 5.5 UPGRADE An out-of-bounds read vulnerability in VrmlData_IndexedLineSet::TShape in the VRML parser in Open CASCADE Tech
- CVE-2026-42478 HIGH 7.5 UPGRADE An issue was discovered in VrmlData_IndexedFaceSet::TShape in the VRML V2.0 parser in Open CASCADE Technology
- CVE-2026-42477 HIGH 7.1 UPGRADE A heap-based out-of-bounds read vulnerability in RWObj_Reader::read in the OBJ file parser in Open CASCADE Tec
- CVE-2026-42476 HIGH 7.1 UPGRADE Two heap-based out-of-bounds read vulnerabilities in the STL ASCII file parser in Open CASCADE Technology (OCC