Open CASCADE Technology (OCCT) version 8.0.0_rc5 contains multiple weaknesses in its IGES and STEP file parsers that are triggered by crafted files. One flaw is an out-of-bounds read in the evaluation of IGES B-spline curves, another occurs when building STEP B-spline curves, and a third flaw causes infinite recursion when processing a self-referential OrientedEdge entity. Each of these issues can lead either to a program crash or to the unintended disclosure of memory contents, affecting the confidentiality, integrity and availability of the application.

The vulnerabilities affect only installations that use the 8.0.0_rc5 release of OCCT. No other vendors or product versions are listed, so the impact is limited to that specific release.

The CVSS score of 5.5 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by providing malicious IGES or STEP files; the attack vector is inferred to rely on file input, which may be local or supplied remotely depending on the target application. Successful exploitation would cause either a denial-of-service or disclosure of internal memory data.