CVE-2020-28620

Vulnerability

An out-of-bounds read vulnerability exists in the SNC_io_parser::read_edge() function within the Nef polygon-parsing functionality of CGAL libcgal. This occurs in the handling of malformed Nef files, leading to type confusion and potential code execution. The vulnerability affects CGAL versions prior to 5.4.1 [1][2].

Exploitation

An attacker can exploit this vulnerability by providing a specially crafted malformed file (e.g., .nef3) to a system using CGAL. No authentication or user interaction is required; the attack is remote and can be triggered automatically when the file is parsed.

Impact

Successful exploitation allows an attacker to achieve arbitrary code execution in the context of the application processing the file. This can lead to complete compromise of confidentiality, integrity, and availability.

Mitigation

The vulnerability is fixed in CGAL version 5.4.1 and later [2]. Users should upgrade to this version or apply patches provided by their distribution. No known workarounds are available [2].