A heap-based out-of-bounds read vulnerability in the Open CASCADE Technology OBJ file parser poses a risk of denial of service or information disclosure when processing malicious files.

This is a heap-based out-of-bounds read vulnerability located in the RWObj_Reader::read function. The flaw occurs because the system fails to validate buffer lengths during the processing of OBJ file lines, allowing for memory access errors when an attacker provides a specially crafted file.

The vulnerability carries a CVSS score of 7.1, indicating a high potential for service disruption. Successful exploitation could lead to application crashes, causing system downtime for users relying on OCCT-based software, or the exposure of sensitive data stored in memory.

Immediate Action: Organizations using OCCT V8_0_0_rc5 should restrict the processing of untrusted OBJ files and monitor vendor channels for the release of a corrective patch.

Proactive Monitoring: Security teams should monitor application logs for unexpected termination events or error codes associated with file parsing modules within the software.

Compensating Controls: Implement file integrity checks and restrict file import capabilities to trusted sources to prevent the introduction of malicious OBJ files into the production environment.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced GitHub Gist.

Given the potential for denial of service and the existence of a public proof-of-concept, this vulnerability should be treated with high priority. Administrators must limit exposure by restricting file ingestion and preparing to apply vendor-supplied patches as soon as they become available to prevent exploitation of this memory safety flaw.