Executive brief
Open CASCADE Technology is a software development platform used for 3D computer-aided design (CAD) and engineering data exchange. Multiple vulnerabilities in its file parsers allow an attacker to crash the application or potentially access sensitive memory by providing specially crafted 3D model files (IGES or STEP formats). This could lead to service disruptions for engineers and designers or the unauthorized disclosure of technical data.
Technical details
This advisory covers multiple memory safety issues within the IGES and STEP parsers of OCCT. Specifically, Geom2d_BSplineCurve::EvalD0 contains an out-of-bounds read triggered when crafted knot multiplicity pushes evaluation outside pole bounds. Additionally, MakeBSplineCurveCommon in the STEP parser suffers from an out-of-bounds read during curve construction, and StepShape_OrientedEdge::EdgeStart is susceptible to infinite recursion when processing self-referential OrientedEdge entities. These vulnerabilities are reachable via local file processing of malformed IGES or STEP files. Successful exploitation can result in a crash (Denial of Service) or unintended memory disclosure due to out-of-bounds reads. Range validation for pole/knot array indices is required to mitigate these issues.
Affected products
- Open CASCADE SAS Open CASCADE Technology <= 7.8.1, 8.0.0_rc5, master through commit c540f316
Timeline
- 2026-04-30: disclosed: Initial disclosure by Innora Security Research
- 2026-05-01: advisory: NVD publication date