The vulnerability is a heap‑based out‑of‑bounds read caused by insufficient validation in the OBJ file parser. When a minimal line is read, the parser may read beyond the allocated buffer, potentially exposing memory contents or crashing the application. Attacking this weakness could result in a denial of service or leakage of sensitive data. This is a classic example of a CWE‑125 vulnerability: Out‑of‑Bounds Read. The likely attack vector is user‑assisted, as an attacker must persuade a victim to open a crafted OBJ file. The impact is limited to the machine running the software, but the severity depends on the sensitivity of the data accessed by the read.

Open CASCADE Technology (OCCT) version 8.0.0 RC5 contains the vulnerable OBJ parser. No other affected vendors or versions are publicly listed.

The CVSS score of 5.5 indicates a medium severity vulnerability. The EPSS score is unavailable and the vulnerability is not listed in CISA’s KEV catalog, so the current exploitation probability is unclear. However, because the flaw requires a user interaction to open a malicious file, the risk is primarily to environments where users can be induced to open unknown OBJ files or to compromised systems that process such files automatically. The potential impact—service disruption or data compromise—remains high if the vulnerability is successfully triggered. Organizations should treat this as a significant risk when the software processes external OBJ files.