CVE-2020-28631

Vulnerability

An out-of-bounds read vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. Specifically, in the SNC_io_parser::read_sedge() function within SNC_io_parser.h, the parser fails to properly validate array indices when reading the seh->source() field, leading to an OOB read and type confusion. This can be triggered by a specially crafted malformed .nef3 file [1].

Exploitation

An attacker can exploit this vulnerability by providing a malicious .nef3 file to an application that uses the CGAL library to parse Nef polygons. No authentication or user interaction is required; the exploit can occur remotely if the application processes untrusted input. The attacker does not need any special network position beyond the ability to supply the file [1].

Impact

Successful exploitation of the OOB read and type confusion can lead to arbitrary code execution in the context of the process using CGAL. The CVSSv3 score is 10.0, indicating a critical impact on confidentiality, integrity, and availability [1].

Mitigation

The vulnerability is fixed in CGAL version 5.4.1 and later [2]. Users should upgrade to this version or later. As of the publication date, no known workaround exists, and the issue is not known to be listed in CISA's KEV [2].