EUVD-2026-26602Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
An out-of-bounds read vulnerability in VrmlData_IndexedLineSet::TShape in the VRML parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 allows attackers to cause a denial of service via a crafted VRML file. The issue occurs because coordIndex values from parsed input are used as direct array indices without validation against the size of the coordinate array during geometry processing.
AnalysisAI
Out-of-bounds read in Open CASCADE Technology V8_0_0_rc5 VRML parser allows denial of service when processing crafted VRML files with invalid coordIndex values. The vulnerability exists in VrmlData_IndexedLineSet::TShape geometry processing, where array indices are used without bounds validation, enabling local attackers with user interaction to crash applications through malformed input.
Technical ContextAI
Open CASCADE Technology (OCCT) is a 3D geometry kernel library used in CAD/CAM software. The VRML (Virtual Reality Modeling Language) parser contains a geometry processing component (VrmlData_IndexedLineSet::TShape) that reads coordinate indices from parsed VRML files. The vulnerability is a classic out-of-bounds read (CWE-125) where coordIndex values from user-supplied VRML data are directly used as array indices into the coordinate array without validation. This violates bounds-checking safety protocols in memory-safe code, allowing reads beyond allocated buffer boundaries. The affected CPE indicates the vulnerability affects OCCT products, though the specific vendor organization is classified as 'n/a' in the available data.
RemediationAI
Upgrade to the latest patched version of Open CASCADE Technology beyond V8_0_0_rc5 (specific fix version not provided in available data; contact OCCT vendor for confirmed patch version). Immediate workaround: disable VRML file import in CAD applications until patching is possible, or implement input validation pre-processing that validates all coordIndex values against the coordinate array size before geometry processing. Users should avoid opening VRML files from untrusted sources. Apply principle of least privilege to limit application access to system resources that could be exploited if denial of service leads to resource exhaustion. Contact the Open CASCADE Technology vendor for confirmed patch availability and timeline.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today