CVE-2020-28622

Vulnerability

The vulnerability resides in the Nef_S2/SNC_io_parser.h function SNC_io_parser::read_edge(), specifically in the handling of eh->incident_sface(). An out-of-bounds read occurs when parsing a specially crafted .nef3 file, which also triggers type confusion. Affected is CGAL libcgal version 5.1.1 [1]. Multiple related CVEs cover a range of similar parsing bugs in the Nef polygon functionality [1].

Exploitation

An attacker can provide a malicious .nef3 file to an application using CGAL's Nef polygon parsing. No authentication or special network position is required; the attack vector is remote and requires user interaction (e.g., opening the file). The parsing code does not properly validate array indices, leading to an out-of-bounds read that can be leveraged for type confusion [1].

Impact

Successful exploitation results in code execution with the privileges of the process using CGAL. The CVSSv3 score is 10.0, indicating a critical impact on confidentiality, integrity, and availability [1]. An attacker can gain full control over the affected system.

Mitigation

The vulnerability is patched in CGAL version 5.4.1, released in April 2023 [2]. Users should upgrade to at least this version. No known workaround exists [2]. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.