CVE-2026-42481 Memory corruption in n/a
Crafted IGES or STEP files can trigger out-of-bounds reads or infinite recursion in OCCT, leading to denial of service or memory disclosure.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-42481?
CVE-2026-42481 is a medium-severity memory corruption vulnerability in n/a, published on 1 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Open CASCADE Technology (OCCT) V8_0_0_rc5 contains multiple vulnerabilities in its IGES and STEP file parsers that can be triggered by crafted IGES or STEP files. These issues include an out-of-bounds read in Geom2d_BSplineCurve::EvalD0 during IGES B-spline curve evaluation, an out-of-bounds read in MakeBSplineCurveCommon during STEP B-spline curve construction, and infinite recursion in StepShape_OrientedEdge::EdgeStart when processing a self-referential OrientedEdge entity. Successful exploitation may result in denial of service or unintended memory disclosure.
Weakness: CWE-125
Which versions are affected by CVE-2026-42481?
It affects 1 product.
Products include Opencascade Open Cascade Technology.
How do I fix CVE-2026-42481?
No fix has been published for CVE-2026-42481 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-42481 being exploited?
There is no known exploitation of CVE-2026-42481 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2026-42481, GHSA-8wqm-37mp-6rrm, UBUNTU-CVE-2026-42481.