CVE-2020-28617
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 10epss 2.3%
exploitation probability
2.3%top 18% of all CVEs
observed exploitation
nono source reports it
In short
A vulnerability in CGAL library's polygon parsing allows attackers to crash applications or execute malicious code by providing specially crafted malformed files. The flaw occurs when the parser incorrectly reads data from memory, causing unpredictable behavior.
Technical detail
An out-of-bounds read in Nef_S2/SNC_io_parser.h's read_vertex() function allows type confusion and arbitrary code execution when processing malformed polygon input files. The attack requires only the ability to provide input to an application using the affected CGAL library version (≤5.1.1); successful exploitation leads to full process compromise.
Summary generated and translated by AI from the official description.
Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_vertex() vh->sfaces_last().
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
CGAL Project · libcgal