CVE-2024-23948

NameCVE-2024-23948
DescriptionMultiple improper array index validation vulnerabilities exist in the readMSH functionality of libigl v2.5.0. A specially crafted .msh file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability concerns the `igl::MshLoader::parse_nodes` function while handling an `ascii`.msh` file.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Notes

NOT-FOR-US: libigl
slic3r-prusa bundles a copy, but it's not used for reading files
https://github.com/prusa3d/PrusaSlicer/issues/12905 and #1074233
https://talosintelligence.com/vulnerability_reports/TALOS-2024-1926
https://github.com/libigl/libigl/issues/2387

Search for package or bug name: Reporting problems