CVE-2026-42481 identifies multiple vulnerabilities in OCCT V8_0_0_rc5 affecting the IGES and STEP file parsers. Specifically, an out-of-bounds read occurs in Geom2d_BSplineCurve::EvalD0 during IGES B-spline curve evaluation, another out-of-bounds read in MakeBSplineCurveCommon during STEP B-spline curve construction, and infinite recursion in StepShape_OrientedEdge::EdgeStart when handling a self-referential OrientedEdge entity. These flaws can be triggered by crafted IGES or STEP files, potentially causing denial of service or memory disclosure.

Successful exploitation of these vulnerabilities may result in denial of service conditions or unintended disclosure of memory contents. There is no evidence of active exploitation in the wild. The vulnerabilities affect parsing of specially crafted IGES or STEP files, which could be used to disrupt applications relying on OCCT V8_0_0_rc5 for CAD data processing.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when processing untrusted IGES or STEP files with OCCT V8_0_0_rc5. No official remediation or temporary fixes have been published at this time.