# CVE-2026-42481: Open CASCADE Technology OOB read and recursion in IGES and STEP parsers

Source: https://junglewise.ai/threats/cve-2026-42481-open-cascade-technology-oob-read-and-recursion-in-iges-and-step  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-01. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2026-42481 · Severity: medium · CVSS 5.5 · Published 2026-05-01

Open CASCADE Technology is a software development platform used for 3D computer-aided design (CAD) and engineering data exchange. Multiple vulnerabilities in its file parsers allow an attacker to crash the application or potentially access sensitive memory by providing specially crafted 3D model files (IGES or STEP formats). This could lead to service disruptions for engineers and designers or the unauthorized disclosure of technical data.

## Quick answers

**Is CVE-2026-42481 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42481 being exploited in the wild.

**How severe is CVE-2026-42481?** Medium severity, with a CVSS score of 5.5, published 1 May 2026.

**Which products and versions are affected?** Open CASCADE SAS Open CASCADE Technology <= 7.8.1, 8.0.0_rc5, master through commit c540f316.

**Is there a fix for CVE-2026-42481?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-42481 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-42481?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This advisory covers multiple memory safety issues within the IGES and STEP parsers of OCCT. Specifically, Geom2d_BSplineCurve::EvalD0 contains an out-of-bounds read triggered when crafted knot multiplicity pushes evaluation outside pole bounds. Additionally, MakeBSplineCurveCommon in the STEP parser suffers from an out-of-bounds read during curve construction, and StepShape_OrientedEdge::EdgeStart is susceptible to infinite recursion when processing self-referential OrientedEdge entities. These vulnerabilities are reachable via local file processing of malformed IGES or STEP files. Successful exploitation can result in a crash (Denial of Service) or unintended memory disclosure due to out-of-bounds reads. Range validation for pole/knot array indices is required to mitigate these issues.

## Affected products

- Open CASCADE SAS Open CASCADE Technology <= 7.8.1, 8.0.0_rc5, master through commit c540f316

## Timeline

- 2026-04-30: disclosed: Initial disclosure by Innora Security Research
- 2026-05-01: advisory: NVD publication date

## References

- [https://gist.github.com/sgInnora/dfba083d04906283e9c92aea78e2d94a](https://gist.github.com/sgInnora/dfba083d04906283e9c92aea78e2d94a)