CVE-2023-35952

What it actually does

Stack-based buffer overflow in readOFF.cpp during parsing of comments in the geometric faces section of .off files, enabling arbitrary code execution.

Why it matters to the business

Applications relying on the vulnerable library can be compromised when users open crafted files, potentially leading to unauthorized code execution and system control.

How an attack unfolds

An attacker crafts a malicious .off file containing oversized comment data in the faces section; when an application using the library loads the file, the overflow occurs and attacker-supplied code executes.

How to fix it

Upgrade libigl to a version containing corrected bounds checking in readOFF.cpp comment parsing. Rebuild and redeploy dependent applications. Until a patch is available, restrict processing of untrusted .off files.

How to confirm the fix worked

Confirm the installed libigl version is newer than 2.4.0, run regression tests with known-malicious .off samples, and verify absence of the overflow via static or dynamic analysis of the faces-section parser.

Typical attack path

1. Create a specially crafted .off file with oversized comments in the faces section
2. Deliver the file to a target via email, download, or shared storage
3. Victim opens the file in an application linked against the vulnerable library version
4. Parser in readOFF.cpp overflows the stack buffer and redirects execution

How to detect it

Search application logs and crash reports for abnormal termination while parsing .off files; inspect process memory dumps for stack corruption patterns near comment-handling code; correlate file-open events with subsequent suspicious child processes or network activity.

What your security team should do

• Inventory all products and build pipelines that depend on libigl and schedule upgrades
• Add file-type and size validation gates before any .off file is passed to the library
• Enable ASLR, stack canaries, and OS-level exploit mitigations on hosts running affected software
• Monitor EPSS and vendor advisories for a future patch release given the 871-day publication window