CVE-2026-2653

NameCVE-2026-2653
DescriptionA security flaw has been discovered in admesh up to 0.98.5. This issue affects the function stl_check_normal_vector of the file src/normals.c. Performing a manipulation results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. It looks like this product is not really maintained anymore.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
admesh (PTS)bullseye0.98.4-1vulnerable
bookworm0.98.4-2vulnerable
forky, sid, trixie0.98.5-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
admeshsource(unstable)(unfixed)

Notes

https://github.com/admesh/admesh/issues/65

Search for package or bug name: Reporting problems