CVE-2026-42480: Opencascade Open Cascade Technology

Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days.

A stack-based out-of-bounds read vulnerability in VrmlData_Scene::ReadLine in the VRML parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 allows attackers to cause a denial of service via a crafted VRML file. The issue occurs because the quoted-string escape handler uses ptr[++anOffset] without proper bounds checking, which can read past the end of a fixed-size stack buffer.

Affected products

• Opencascade Open Cascade Technology: up to and including 7.9.3; version 8.0.0 only

Published 2026-05-01. Last modified 2026-06-17.