CVE-2023-35949

What it actually does

Stack-based buffer overflow in readOFF.cpp during parsing of geometric faces in .off files, enabling arbitrary code execution.

Why it matters to the business

Applications relying on the library risk full system compromise when users process untrusted 3D model files, potentially leading to data loss or unauthorized access.

How an attack unfolds

An attacker crafts a malicious .off file that overflows a stack buffer while the library parses face data, causing the vulnerable application to execute attacker-supplied code upon file processing.

How to fix it

Upgrade libigl to a version that resolves the stack-based buffer overflows in readOFF.cpp; rebuild and redeploy dependent applications with the patched library.

How to confirm the fix worked

Confirm the installed libigl version is newer than 2.4.0, run regression tests with malformed .off files, and verify absence of crashes or memory corruption under fuzzing.

Typical attack path

1. Craft a specially formed .off file that triggers buffer overflow during face parsing
2. Deliver the file to the target via email, download, or shared storage
3. Convince the victim to open the file in an application using the vulnerable library
4. Exploit the overflow to achieve arbitrary code execution

How to detect it

Review application and system logs for segmentation faults or crashes during .off file parsing; inspect process memory dumps for signs of stack corruption after handling model imports.

What your security team should do

• Prioritize updating libigl across all build pipelines and applications
• Restrict or sandbox processing of untrusted .off files until patched
• Add file-type validation and size limits for imported 3D models