CVE-2020-35635
CVE-2020-35635
In short
A flaw in CGAL's 3D shape-parsing code allows attackers to craft a malicious file that causes the program to read memory it shouldn't access and misinterpret data types, potentially letting them run arbitrary code on the victim's system.
Technical detail
An out-of-bounds read vulnerability in Nef_S2/SNC_io_parser.h (read_sface/store_sm_boundary_item) allows type confusion when parsing specially crafted polygon input files. The attack vector is file-based; exploitation requires the victim to open a malicious file with CGAL-dependent software, resulting in memory disclosure and potential arbitrary code execution.
Summary generated and translated by AI from the official description.
A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1 in Nef_S2/SNC_io_parser.h SNC_io_parser::read_sface() store_sm_boundary_item() Sloop_of OOB read. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger this vulnerability.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
n/a · CGAL ProjectWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →