Open CASCADE Technology (OCCT) V8_0_0_rc5 contains multiple vulnerabilities in its IGES and STEP file parsers that can be triggered by crafted IGES or STEP files. These issues include an out-of-bounds read in Geom2d_BSplineCurve::EvalD0 during IGES B-spline curve evaluation, an out-of-bounds read in MakeBSplineCurveCommon during STEP B-spline curve construction, and infinite recursion in StepShape_OrientedEdge::EdgeStart when processing a self-referential OrientedEdge entity. Successful exploitation may result in denial of service or unintended memory disclosure.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 7.9.3CPE matchmatch criteria | cpe:2.3:a:opencascade:open_cascade_technology:*:*:*:*:*:*:*:* | ||
8.0.0CPE matchmatch criteria | cpe:2.3:a:opencascade:open_cascade_technology:8.0.0:beta1:*:*:*:*:*:* | ||
8.0.0CPE matchmatch criteria | cpe:2.3:a:opencascade:open_cascade_technology:8.0.0:rc1:*:*:*:*:*:* | ||
8.0.0CPE matchmatch criteria | cpe:2.3:a:opencascade:open_cascade_technology:8.0.0:rc2:*:*:*:*:*:* | ||
8.0.0CPE matchmatch criteria | cpe:2.3:a:opencascade:open_cascade_technology:8.0.0:rc3:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.