CVE-2020-28627
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 10epss 2.3%
exploitation probability
2.3%top 19% of all CVEs
observed exploitation
nono source reports it
In short
CGAL library has a critical vulnerability in its polygon parsing code that allows attackers to execute arbitrary code by providing specially crafted malformed files, which trigger memory reading and type confusion errors.
Technical detail
Out-of-bounds read vulnerability in Nef_S2/SNC_io_parser.h's read_volume() function allows type confusion when processing malformed polygon input files, enabling arbitrary code execution with no authentication required. The vulnerability affects CGAL versions up to 5.1.1 and requires only a malicious input file to trigger.
Summary generated and translated by AI from the official description.
Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_volume() ch->shell_entry_objects().
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
CGAL Project · libcgal