CVE-2020-35636
CVE-2020-35636
In short
A flaw in CGAL's polygon parser allows an attacker to craft a malicious file that triggers an out-of-bounds memory read, potentially leading to code execution on any system processing the file.
Technical detail
An out-of-bounds read vulnerability in CGAL-5.1.1's Nef_S2/SNC_io_parser.h::read_sface() function allows type confusion when parsing specially crafted polygon files; exploitation requires providing a malformed input file to an application using the vulnerable library, potentially achieving arbitrary code execution.
Summary generated and translated by AI from the official description.
A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1 in Nef_S2/SNC_io_parser.h SNC_io_parser::read_sface() sfh->volume() OOB read. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger this vulnerability.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
n/a · CGAL ProjectWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →