CVE-2020-28630

Vulnerability

An out-of-bounds read vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL‑5.1.1, specifically in Nef_S2/SNC_io_parser.h within the SNC_io_parser::read_sedge() function when accessing seh->snext(). The bug is triggered when the parser handles a specially crafted malformed .nef3 file, leading to insufficient bounds checking and type confusion. CGAL‑5.1.1 and potentially earlier versions are affected [1].

Exploitation

No authentication or user interaction beyond opening a malformed file is required. An attacker can deliver a crafted .nef3 file (or other Nef polygon input) to a target application that uses CGAL's parsing routines. When the file is parsed, the vulnerable read_sedge code path is exercised, resulting in an out-of-bounds read offset that can corrupt adjacent memory [1].

Impact

Successful exploitation can lead to arbitrary code execution in the context of the process using libcgal. The confidentiality, integrity, and availability of the system are fully compromised (CVSSv3 10.0) [1].

Mitigation

CGAL has addressed these vulnerabilities in version 5.4.1 and later, according to the Gentoo security advisory [2]. Users should upgrade to >=sci-mathematics/cgal-5.4.1. No known workaround exists for unpatched versions. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog.