CVE-2020-28616

Vulnerability

An out-of-bounds read vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. Specifically, in Nef_S2/SNC_io_parser.h, the function SNC_io_parser::read_vertex() accesses vh->sfaces_begin() without proper bounds checking, leading to an out-of-bounds read and type confusion [1]. This is one of multiple code execution vulnerabilities in the Nef polygon parser, all triggered by specially crafted malformed files [1].

Exploitation

An attacker can exploit this vulnerability by providing a maliciously crafted .nef3 file to an application using CGAL. No authentication or user interaction beyond opening the file is required. The parser processes the malformed input, causing an out-of-bounds read that leads to type confusion, which can be leveraged for code execution [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the process using CGAL. This results in complete compromise of confidentiality, integrity, and availability. The CVSSv3 score is 10.0 (Critical) [1].

Mitigation

The vulnerability is fixed in CGAL version 5.4.1 and later [2]. Users should upgrade to at least this version. No known workaround exists for earlier versions [2].