UBUNTU-CVE-2026-42479

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-42479

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42479.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-42479

Upstream

CVE-2026-42479

Published

2026-05-01T15:16:00Z

Modified

2026-05-20T16:25:44.715279080Z

Severity

5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

An out-of-bounds read vulnerability in VrmlDataIndexedLineSet::TShape in the VRML parser in Open CASCADE Technology (OCCT) V800rc5 allows attackers to cause a denial of service via a crafted VRML file. The issue occurs because coordIndex values from parsed input are used as direct array indices without validation against the size of the coordinate array during geometry processing.

References

Affected packages

Ubuntu:20.04:LTS / opencascade

Package

Name: opencascade
Purl: pkg:deb/ubuntu/opencascade?arch=source&distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

7.*

7.3.3+dfsg1-1

7.3.3+dfsg1-1build1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libocct-data-exchange-7.3",
            "binary_version": "7.3.3+dfsg1-1build1"
        },
        {
            "binary_name": "libocct-draw-7.3",
            "binary_version": "7.3.3+dfsg1-1build1"
        },
        {
            "binary_name": "libocct-foundation-7.3",
            "binary_version": "7.3.3+dfsg1-1build1"
        },
        {
            "binary_name": "libocct-modeling-algorithms-7.3",
            "binary_version": "7.3.3+dfsg1-1build1"
        },
        {
            "binary_name": "libocct-modeling-data-7.3",
            "binary_version": "7.3.3+dfsg1-1build1"
        },
        {
            "binary_name": "libocct-ocaf-7.3",
            "binary_version": "7.3.3+dfsg1-1build1"
        },
        {
            "binary_name": "libocct-visualization-7.3",
            "binary_version": "7.3.3+dfsg1-1build1"
        },
        {
            "binary_name": "occt-draw",
            "binary_version": "7.3.3+dfsg1-1build1"
        },
        {
            "binary_name": "occt-misc",
            "binary_version": "7.3.3+dfsg1-1build1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42479.json"

Ubuntu:22.04:LTS / opencascade

Package

Name: opencascade
Purl: pkg:deb/ubuntu/opencascade?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

7.*

7.5.1+dfsg1-2

7.5.1+dfsg1-2ubuntu1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libocct-data-exchange-7.5",
            "binary_version": "7.5.1+dfsg1-2ubuntu1"
        },
        {
            "binary_name": "libocct-draw-7.5",
            "binary_version": "7.5.1+dfsg1-2ubuntu1"
        },
        {
            "binary_name": "libocct-foundation-7.5",
            "binary_version": "7.5.1+dfsg1-2ubuntu1"
        },
        {
            "binary_name": "libocct-modeling-algorithms-7.5",
            "binary_version": "7.5.1+dfsg1-2ubuntu1"
        },
        {
            "binary_name": "libocct-modeling-data-7.5",
            "binary_version": "7.5.1+dfsg1-2ubuntu1"
        },
        {
            "binary_name": "libocct-ocaf-7.5",
            "binary_version": "7.5.1+dfsg1-2ubuntu1"
        },
        {
            "binary_name": "libocct-visualization-7.5",
            "binary_version": "7.5.1+dfsg1-2ubuntu1"
        },
        {
            "binary_name": "occt-draw",
            "binary_version": "7.5.1+dfsg1-2ubuntu1"
        },
        {
            "binary_name": "occt-misc",
            "binary_version": "7.5.1+dfsg1-2ubuntu1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42479.json"

Ubuntu:24.04:LTS / opencascade

Package

Name: opencascade
Purl: pkg:deb/ubuntu/opencascade?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

7.*

7.6.3+dfsg1-7

7.6.3+dfsg1-7.1

7.6.3+dfsg1-7.1build1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libocct-data-exchange-7.6t64",
            "binary_version": "7.6.3+dfsg1-7.1build1"
        },
        {
            "binary_name": "libocct-draw-7.6t64",
            "binary_version": "7.6.3+dfsg1-7.1build1"
        },
        {
            "binary_name": "libocct-foundation-7.6t64",
            "binary_version": "7.6.3+dfsg1-7.1build1"
        },
        {
            "binary_name": "libocct-modeling-algorithms-7.6t64",
            "binary_version": "7.6.3+dfsg1-7.1build1"
        },
        {
            "binary_name": "libocct-modeling-data-7.6t64",
            "binary_version": "7.6.3+dfsg1-7.1build1"
        },
        {
            "binary_name": "libocct-ocaf-7.6t64",
            "binary_version": "7.6.3+dfsg1-7.1build1"
        },
        {
            "binary_name": "libocct-visualization-7.6t64",
            "binary_version": "7.6.3+dfsg1-7.1build1"
        },
        {
            "binary_name": "occt-draw",
            "binary_version": "7.6.3+dfsg1-7.1build1"
        },
        {
            "binary_name": "occt-misc",
            "binary_version": "7.6.3+dfsg1-7.1build1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42479.json"

Ubuntu:25.10 / opencascade

Package

Name: opencascade
Purl: pkg:deb/ubuntu/opencascade?arch=source&distro=questing

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

7.*

7.8.1+dfsg1-3

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libocct-data-exchange-7.8",
            "binary_version": "7.8.1+dfsg1-3"
        },
        {
            "binary_name": "libocct-draw-7.8",
            "binary_version": "7.8.1+dfsg1-3"
        },
        {
            "binary_name": "libocct-foundation-7.8",
            "binary_version": "7.8.1+dfsg1-3"
        },
        {
            "binary_name": "libocct-modeling-algorithms-7.8",
            "binary_version": "7.8.1+dfsg1-3"
        },
        {
            "binary_name": "libocct-modeling-data-7.8",
            "binary_version": "7.8.1+dfsg1-3"
        },
        {
            "binary_name": "libocct-ocaf-7.8",
            "binary_version": "7.8.1+dfsg1-3"
        },
        {
            "binary_name": "libocct-visualization-7.8",
            "binary_version": "7.8.1+dfsg1-3"
        },
        {
            "binary_name": "occt-draw",
            "binary_version": "7.8.1+dfsg1-3"
        },
        {
            "binary_name": "occt-misc",
            "binary_version": "7.8.1+dfsg1-3"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42479.json"

Ubuntu:26.04:LTS / opencascade

Package

Name: opencascade
Purl: pkg:deb/ubuntu/opencascade?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

7.*

7.8.1+dfsg1-3

7.9.2+dfsg-2

7.9.2+dfsg-3

7.9.2+dfsg-4

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libocct-data-exchange-7.9",
            "binary_version": "7.9.2+dfsg-4"
        },
        {
            "binary_name": "libocct-draw-7.9",
            "binary_version": "7.9.2+dfsg-4"
        },
        {
            "binary_name": "libocct-foundation-7.9",
            "binary_version": "7.9.2+dfsg-4"
        },
        {
            "binary_name": "libocct-ivtk-7.9",
            "binary_version": "7.9.2+dfsg-4"
        },
        {
            "binary_name": "libocct-modeling-algorithms-7.9",
            "binary_version": "7.9.2+dfsg-4"
        },
        {
            "binary_name": "libocct-modeling-data-7.9",
            "binary_version": "7.9.2+dfsg-4"
        },
        {
            "binary_name": "libocct-ocaf-7.9",
            "binary_version": "7.9.2+dfsg-4"
        },
        {
            "binary_name": "libocct-visualization-7.9",
            "binary_version": "7.9.2+dfsg-4"
        },
        {
            "binary_name": "occt-draw",
            "binary_version": "7.9.2+dfsg-4"
        },
        {
            "binary_name": "occt-misc",
            "binary_version": "7.9.2+dfsg-4"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42479.json"