Vulnerability · Published May 1, 2026 · Assigned by mitre
CVE-2026-42479
Medium 5.5
In plain English
A medium-severity out-of-bounds read in the opencascade package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).
Official description
An out-of-bounds read vulnerability in VrmlData_IndexedLineSet::TShape in the VRML parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 allows attackers to cause a denial of service via a crafted VRML file. The issue occurs because coordIndex values from parsed input are used as direct array indices without validation against the size of the coordinate array during geometry processing.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | opencascade | no fix listed | DEBIAN-CVE-2026-42479 |
| Debian:13 | opencascade | no fix listed | DEBIAN-CVE-2026-42479 |
| Debian:14 | opencascade | no fix listed | DEBIAN-CVE-2026-42479 |
| Ubuntu:22.04:LTS | opencascade | no fix listed | UBUNTU-CVE-2026-42479 |
| Ubuntu:24.04:LTS | opencascade | no fix listed | UBUNTU-CVE-2026-42479 |
| Ubuntu:25.10 | opencascade | no fix listed | UBUNTU-CVE-2026-42479 |
| Ubuntu:26.04:LTS | opencascade | no fix listed | UBUNTU-CVE-2026-42479 |
| Ubuntu:26.10 | opencascade | no fix listed | UBUNTU-CVE-2026-42479 |
Affected products (as reported)
Weakness: CWE-125 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H