CVE-2020-28617
CVE-2020-28617
In short
A vulnerability in CGAL library's polygon parsing allows attackers to crash applications or execute malicious code by providing specially crafted malformed files. The flaw occurs when the parser incorrectly reads data from memory, causing unpredictable behavior.
Technical detail
An out-of-bounds read in Nef_S2/SNC_io_parser.h's read_vertex() function allows type confusion and arbitrary code execution when processing malformed polygon input files. The attack requires only the ability to provide input to an application using the affected CGAL library version (≤5.1.1); successful exploitation leads to full process compromise.
Summary generated and translated by AI from the official description.
Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_vertex() vh->sfaces_last().
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
CGAL Project · libcgalWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →