CVE-2026-42480: Open CASCADE VRML Parser DoS Vulnerability

CVE-2026-42480 Overview

CVE-2026-42480 is a stack-based out-of-bounds read vulnerability in Open CASCADE Technology (OCCT) version V8_0_0_rc5. The flaw resides in the VrmlData_Scene::ReadLine function within the Virtual Reality Modeling Language (VRML) parser. An attacker who supplies a crafted VRML file can trigger the parser to read past the end of a fixed-size stack buffer. The result is a denial of service condition affecting any application that uses OCCT to process untrusted VRML input. The issue is tracked under CWE-125: Out-of-bounds Read.

Critical Impact

A crafted VRML file processed by OCCT V8_0_0_rc5 can crash the host application by triggering an out-of-bounds read in the quoted-string escape handler of the VRML parser.

Affected Products

• Open CASCADE Technology (OCCT) V8_0_0_rc5
• Applications and CAD tooling that link the OCCT VRML parser
• Pipelines that ingest VRML files through OCCT for 3D model conversion

Discovery Timeline

• 2026-05-01 - CVE-2026-42480 published to NVD
• 2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-42480

Vulnerability Analysis

The vulnerability lives in VrmlData_Scene::ReadLine, the routine OCCT uses to tokenize lines from a VRML scene file. The parser maintains a fixed-size stack buffer to hold characters of the current line and an offset variable, anOffset, that tracks the current position. When the parser encounters a quoted string, it enters an escape-handling branch that consumes additional characters from the buffer.

Inside that branch, the code dereferences ptr[++anOffset] to look at the character following the backslash. The pre-increment advances anOffset and reads the next byte without first checking whether the new index is still within the bounds of the buffer. A VRML file can be crafted so the escape sequence appears at the very end of the stack buffer, causing the read to extend past the allocated region. The process aborts or crashes once the read touches an unmapped or guarded stack page.

Root Cause

The root cause is missing bounds validation on anOffset before indexing the buffer. The quoted-string escape handler trusts that another character follows the backslash and increments the index without comparing it against the buffer length. This is a classic [CWE-125] out-of-bounds read introduced by ad-hoc parser logic that lacks a length-aware iterator.

Attack Vector

Exploitation requires local access and the ability to have the target application open or import an attacker-supplied VRML file. The attacker does not need elevated privileges beyond those required to provide a file, and no user interaction beyond opening the model is needed. The impact is limited to availability: confidentiality and integrity are not affected because the read does not return data to the attacker, and arbitrary write primitives are not exposed. The vulnerability mechanism is described in the GitHub Gist PoC Repository.

Detection Methods for CVE-2026-42480

Indicators of Compromise

• Unexpected crashes or aborts in processes that load OCCT (TKVRML, DRAWEXE, or downstream CAD tools) shortly after opening a .wrl or .vrml file.
• Stack trace frames referencing VrmlData_Scene::ReadLine in core dumps or Windows Error Reporting telemetry.
• VRML files with unusually long lines or with backslash escapes positioned at end-of-line boundaries inside quoted strings.

Detection Strategies

• Run OCCT-based tooling under AddressSanitizer or Application Verifier in test environments to surface out-of-bounds reads in VrmlData_Scene::ReadLine before deployment.
• Inspect file ingestion logs for .wrl and .vrml uploads from untrusted sources and correlate with subsequent process exit codes.
• Hash known-bad PoC samples from the public gist and add them to file reputation services for the parsing fleet.

Monitoring Recommendations

• Alert on repeated abnormal terminations of CAD or 3D-conversion services that process user-supplied geometry files.
• Capture and retain core dumps from VRML processing nodes so the faulting frame can be confirmed against VrmlData_Scene::ReadLine.
• Track OCCT version inventory across build agents, render farms, and engineering workstations to identify systems still on V8_0_0_rc5.

How to Mitigate CVE-2026-42480

Immediate Actions Required

• Identify all systems running OCCT V8_0_0_rc5 and restrict their exposure to untrusted VRML input until a fixed build is deployed.
• Block or quarantine VRML files received from external sources at the email gateway and file transfer layer.
• Run VRML conversion workloads inside sandboxed or containerized processes with restart policies so a crash does not take down the broader service.

Patch Information

No vendor patch advisory is referenced in the published CVE record at the time of writing. Monitor the Open CASCADE Technology project for releases that follow V8_0_0_rc5 and apply any fix that adds bounds checks to VrmlData_Scene::ReadLine. Until a release is available, organizations can build OCCT from source after adding a length check before each ptr[++anOffset] access in the quoted-string escape handler.

Workarounds

• Disable VRML import in applications that do not require it, or route VRML processing through an isolated worker that can be killed and restarted on failure.
• Pre-validate VRML files with a separate parser that enforces line length limits and rejects truncated escape sequences before handing them to OCCT.
• Apply operating system mitigations such as stack guard pages and process-level resource limits so an out-of-bounds read fails fast without destabilizing other workloads.

# Example: run an OCCT-based VRML conversion inside a restricted, restartable sandbox
systemd-run --scope --uid=occt --gid=occt \
  --property=MemoryMax=512M \
  --property=TasksMax=64 \
  --property=NoNewPrivileges=yes \
  /usr/local/bin/occt-vrml-convert --input /srv/incoming/model.wrl --output /srv/out/model.step