Two heap-based out-of-bounds read bugs exist in the STL ASCII file parser of Open CASCADE Technology (OCCT) V8_0_0_rc5. The functions that read lines do not enforce proper buffer length checks before comparing with strncasecmp or directly accessing the data. An attacker can craft an STL file containing lines that are far shorter than expected; when a victim opens the file the parser reads past the end of the allocated buffer, leading to a denial of service or leaking of memory contents. The primary impact is disruption of services and potential exposure of internal data, but no code execution is indicated.

The vulnerability affects the Open CASCADE Technology library (OCCT) version V8_0_0_rc5, specifically the RWStl_Reader::ReadAscii routine used to parse ASCII STL files. No other vendors or products are listed.

No EPSS score is available and the vulnerability is not listed in CISA KEV, indicating that widespread exploitation has not yet been observed. The CVSS score of 5.5 indicates moderate severity, and the attack requires a user‑assisted scenario: an attacker must convince a victim to open a malicious STL file. This social‑engineering prerequisite limits the attack surface to environments where STL files are routinely processed. Thus the combination of denial of service and possible information leakage poses a moderate risk for organizations that accept arbitrary STL inputs.