CVE-2020-28605

Vulnerability

An out-of-bounds read vulnerability exists in the Nef_2/PM_io_parser.h function PM_io_parser::read_hedge() within CGAL versions prior to 5.4.1 [1][2]. The flaw is triggered when parsing a specially crafted malformed .nef3 file, leading to an invalid array index and type confusion. The affected code path resides in the Nef polygon-parsing functionality [1].

Exploitation

An attacker can exploit this vulnerability by supplying a malicious .nef3 (or .nef2 or .nefs2) file to a target application that uses the CGAL library to parse such files. No authentication or user interaction beyond opening the file is required [1]. The out-of-bounds read occurs during the set_vertex call within the vertex record parsing logic, allowing the attacker to control the read offset and potentially corrupt memory [1].

Impact

Successful exploitation can lead to arbitrary code execution in the context of the application using CGAL. The CVSS contains (10.0, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) indicates full compromise of confidentiality, integrity, and availability [1]. An attacker could achieve remote code execution without any prior privileges.

Mitigation

The CGAL project has fixed this vulnerability in versions 5.4.1 and later [2]. Users should upgrade to CGAL 5.4.1 or newer. As a general precaution, avoid processing untrusted .nef3 files with unpatched versions. No other workaround is known [2].