A bug in the VRML parser of Open CASCADE Technology triggers a stack-based out‑of‑bounds read when processing the escape sequence of a quoted string. The out‑of‑bounds read can allow an attacker to provide a malicious VRML file that causes the parser to read beyond a fixed‑size buffer, leading to a crash or halt of the application. The primary consequence is loss of service rather than confidentiality or integrity exposure.

The vulnerability has been identified in Open CASCADE Technology (OCCT) V8_0_0_rc5. No other affected versions or vendors are listed in the available data.

Severity information is available: a CVSS score of 5.5, and the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would require an attacker to provide a crafted VRML file to an application that uses OCCT’s VRML parser, implying a remote attack vector where the victim processes user‑supplied data.