UBUNTU-CVE-2026-42481

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-42481

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42481.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-42481

Upstream

CVE-2026-42481

Published

2026-05-01T16:16:00Z

Modified

2026-05-20T16:25:44.146515768Z

Severity

5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

Open CASCADE Technology (OCCT) V800rc5 contains multiple vulnerabilities in its IGES and STEP file parsers that can be triggered by crafted IGES or STEP files. These issues include an out-of-bounds read in Geom2dBSplineCurve::EvalD0 during IGES B-spline curve evaluation, an out-of-bounds read in MakeBSplineCurveCommon during STEP B-spline curve construction, and infinite recursion in StepShape_OrientedEdge::EdgeStart when processing a self-referential OrientedEdge entity. Successful exploitation may result in denial of service or unintended memory disclosure.

References

Affected packages

Ubuntu:20.04:LTS / opencascade

Package

Name: opencascade
Purl: pkg:deb/ubuntu/opencascade?arch=source&distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

7.*

7.3.3+dfsg1-1

7.3.3+dfsg1-1build1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libocct-data-exchange-7.3",
            "binary_version": "7.3.3+dfsg1-1build1"
        },
        {
            "binary_name": "libocct-draw-7.3",
            "binary_version": "7.3.3+dfsg1-1build1"
        },
        {
            "binary_name": "libocct-foundation-7.3",
            "binary_version": "7.3.3+dfsg1-1build1"
        },
        {
            "binary_name": "libocct-modeling-algorithms-7.3",
            "binary_version": "7.3.3+dfsg1-1build1"
        },
        {
            "binary_name": "libocct-modeling-data-7.3",
            "binary_version": "7.3.3+dfsg1-1build1"
        },
        {
            "binary_name": "libocct-ocaf-7.3",
            "binary_version": "7.3.3+dfsg1-1build1"
        },
        {
            "binary_name": "libocct-visualization-7.3",
            "binary_version": "7.3.3+dfsg1-1build1"
        },
        {
            "binary_name": "occt-draw",
            "binary_version": "7.3.3+dfsg1-1build1"
        },
        {
            "binary_name": "occt-misc",
            "binary_version": "7.3.3+dfsg1-1build1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42481.json"

Ubuntu:22.04:LTS / opencascade

Package

Name: opencascade
Purl: pkg:deb/ubuntu/opencascade?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

7.*

7.5.1+dfsg1-2

7.5.1+dfsg1-2ubuntu1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libocct-data-exchange-7.5",
            "binary_version": "7.5.1+dfsg1-2ubuntu1"
        },
        {
            "binary_name": "libocct-draw-7.5",
            "binary_version": "7.5.1+dfsg1-2ubuntu1"
        },
        {
            "binary_name": "libocct-foundation-7.5",
            "binary_version": "7.5.1+dfsg1-2ubuntu1"
        },
        {
            "binary_name": "libocct-modeling-algorithms-7.5",
            "binary_version": "7.5.1+dfsg1-2ubuntu1"
        },
        {
            "binary_name": "libocct-modeling-data-7.5",
            "binary_version": "7.5.1+dfsg1-2ubuntu1"
        },
        {
            "binary_name": "libocct-ocaf-7.5",
            "binary_version": "7.5.1+dfsg1-2ubuntu1"
        },
        {
            "binary_name": "libocct-visualization-7.5",
            "binary_version": "7.5.1+dfsg1-2ubuntu1"
        },
        {
            "binary_name": "occt-draw",
            "binary_version": "7.5.1+dfsg1-2ubuntu1"
        },
        {
            "binary_name": "occt-misc",
            "binary_version": "7.5.1+dfsg1-2ubuntu1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42481.json"

Ubuntu:24.04:LTS / opencascade

Package

Name: opencascade
Purl: pkg:deb/ubuntu/opencascade?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

7.*

7.6.3+dfsg1-7

7.6.3+dfsg1-7.1

7.6.3+dfsg1-7.1build1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libocct-data-exchange-7.6t64",
            "binary_version": "7.6.3+dfsg1-7.1build1"
        },
        {
            "binary_name": "libocct-draw-7.6t64",
            "binary_version": "7.6.3+dfsg1-7.1build1"
        },
        {
            "binary_name": "libocct-foundation-7.6t64",
            "binary_version": "7.6.3+dfsg1-7.1build1"
        },
        {
            "binary_name": "libocct-modeling-algorithms-7.6t64",
            "binary_version": "7.6.3+dfsg1-7.1build1"
        },
        {
            "binary_name": "libocct-modeling-data-7.6t64",
            "binary_version": "7.6.3+dfsg1-7.1build1"
        },
        {
            "binary_name": "libocct-ocaf-7.6t64",
            "binary_version": "7.6.3+dfsg1-7.1build1"
        },
        {
            "binary_name": "libocct-visualization-7.6t64",
            "binary_version": "7.6.3+dfsg1-7.1build1"
        },
        {
            "binary_name": "occt-draw",
            "binary_version": "7.6.3+dfsg1-7.1build1"
        },
        {
            "binary_name": "occt-misc",
            "binary_version": "7.6.3+dfsg1-7.1build1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42481.json"

Ubuntu:25.10 / opencascade

Package

Name: opencascade
Purl: pkg:deb/ubuntu/opencascade?arch=source&distro=questing

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

7.*

7.8.1+dfsg1-3

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libocct-data-exchange-7.8",
            "binary_version": "7.8.1+dfsg1-3"
        },
        {
            "binary_name": "libocct-draw-7.8",
            "binary_version": "7.8.1+dfsg1-3"
        },
        {
            "binary_name": "libocct-foundation-7.8",
            "binary_version": "7.8.1+dfsg1-3"
        },
        {
            "binary_name": "libocct-modeling-algorithms-7.8",
            "binary_version": "7.8.1+dfsg1-3"
        },
        {
            "binary_name": "libocct-modeling-data-7.8",
            "binary_version": "7.8.1+dfsg1-3"
        },
        {
            "binary_name": "libocct-ocaf-7.8",
            "binary_version": "7.8.1+dfsg1-3"
        },
        {
            "binary_name": "libocct-visualization-7.8",
            "binary_version": "7.8.1+dfsg1-3"
        },
        {
            "binary_name": "occt-draw",
            "binary_version": "7.8.1+dfsg1-3"
        },
        {
            "binary_name": "occt-misc",
            "binary_version": "7.8.1+dfsg1-3"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42481.json"

Ubuntu:26.04:LTS / opencascade

Package

Name: opencascade
Purl: pkg:deb/ubuntu/opencascade?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

7.*

7.8.1+dfsg1-3

7.9.2+dfsg-2

7.9.2+dfsg-3

7.9.2+dfsg-4

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libocct-data-exchange-7.9",
            "binary_version": "7.9.2+dfsg-4"
        },
        {
            "binary_name": "libocct-draw-7.9",
            "binary_version": "7.9.2+dfsg-4"
        },
        {
            "binary_name": "libocct-foundation-7.9",
            "binary_version": "7.9.2+dfsg-4"
        },
        {
            "binary_name": "libocct-ivtk-7.9",
            "binary_version": "7.9.2+dfsg-4"
        },
        {
            "binary_name": "libocct-modeling-algorithms-7.9",
            "binary_version": "7.9.2+dfsg-4"
        },
        {
            "binary_name": "libocct-modeling-data-7.9",
            "binary_version": "7.9.2+dfsg-4"
        },
        {
            "binary_name": "libocct-ocaf-7.9",
            "binary_version": "7.9.2+dfsg-4"
        },
        {
            "binary_name": "libocct-visualization-7.9",
            "binary_version": "7.9.2+dfsg-4"
        },
        {
            "binary_name": "occt-draw",
            "binary_version": "7.9.2+dfsg-4"
        },
        {
            "binary_name": "occt-misc",
            "binary_version": "7.9.2+dfsg-4"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42481.json"