Executive brief
Open CASCADE Technology, a software development platform for 3D computer-aided design (CAD), contains a vulnerability in its VRML file parser. By providing a specially crafted VRML file, an attacker can cause the application to crash or behave unexpectedly. This could lead to a denial of service, impacting the availability of engineering and design tools that rely on this library.
Technical details
A stack-based out-of-bounds read exists in the VrmlData_Scene::ReadLine function within the VRML parser of Open CASCADE Technology (OCCT). The vulnerability is caused by a lack of proper bounds checking in the quoted-string escape handler, which uses an incremented offset (ptr[++anOffset]) to access a fixed-size stack buffer (aBuffer[256]). An attacker can exploit this by providing a VRML node with a line exceeding the expected buffer length (approximately 8376 bytes as reported by ASAN), leading to a read past the end of the stack allocation. This results in a denial of service (application crash). The issue affects versions up to 7.9.3 and 8.0.0-rc5.
Affected products
- Open CASCADE SAS Open CASCADE Technology (OCCT) Up to and including 7.9.3, 8.0.0-beta1 through 8.0.0-rc5
Timeline
- 2026-04-30: disclosed: Initial disclosure by Innora Security Research
- 2026-05-01: advisory: CVE published to NVD