CVE-2020-28625

Vulnerability

In CGAL libcgal version CGAL-5.1.1, the Nef polygon-parsing functionality contains multiple out-of-bounds read and type confusion vulnerabilities. Specifically, in Nef_S2/SNC_io_parser.h, the function SNC_io_parser::read_facet() does not properly validate array indices when processing fh->boundary_entry_objects SLoop_of, allowing an attacker-controlled malformed .nef3 file to trigger these flaws [1]. The vulnerability is classified as CWE-129 (Improper Validation of Array Index) [1].

Exploitation

An attacker needs no authentication or network privileges; the vulnerability is remotely exploitable with no user interaction beyond opening a crafted file [1]. By providing a specially crafted malformed .nef3 file, the attacker can trigger an out-of-bounds read and type confusion in the parsing process, potentially leading to arbitrary write primitives [1].

Impact

Successful exploitation allows an attacker to achieve arbitrary code execution with the privileges of the application using CGAL. This results in a complete compromise of confidentiality, integrity, and availability (CIA) [1]. The CVSSv3 score is 10.0 (Critical) under AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H [1].

Mitigation

A fix was released in CGAL version 5.4.1; users are advised to upgrade to at least this version [2]. The Gentoo security advisory (GLSA 202305-34) recommends upgrading to sci-mathematics/cgal-5.4.1 or later [2]. No workaround is known [2].