CVE-2024-23947

What it actually does

Improper array index validation in igl::MshLoader::parse_nodes allows an out-of-bounds write when processing a specially crafted binary .msh file, enabling memory corruption.

Why it matters to the business

Applications that rely on libigl for mesh processing can be crashed or compromised when users open untrusted .msh files, disrupting 3D modeling workflows and potentially leading to data loss or unauthorized code execution.

How an attack unfolds

An attacker creates a binary .msh file with malformed node data that bypasses array bounds checks inside parse_nodes. The file is delivered to a victim who opens it inside any application linked against the vulnerable libigl library, triggering the out-of-bounds write and allowing the attacker to corrupt memory for code execution or denial of service.

How to fix it

Upgrade libigl to a version that contains the corrected parse_nodes logic. Until a patch is available, disable processing of untrusted binary .msh files or sandbox the application.

How to confirm the fix worked

Confirm the installed libigl version is newer than 2.5.0, then attempt to load a known-good binary .msh file and a test case that previously triggered the bounds violation to verify the crash no longer occurs.

Typical attack path

1. Craft a binary .msh file containing invalid node indices
2. Deliver the file via email, download link, or shared storage
3. Victim opens the file in an application that uses libigl v2.5.0 readMSH functionality
4. parse_nodes processes the file and performs the out-of-bounds write
5. Attacker-controlled data overwrites adjacent memory to achieve code execution or crash

How to detect it

Monitor application crash logs for segmentation faults or access violations during .msh parsing, and inspect file-handling code paths that call MshLoader on externally supplied files.

What your security team should do

• Inventory all builds and dependencies that statically or dynamically link libigl
• Block or quarantine .msh files from untrusted sources until patched
• Apply the upstream fix as soon as a corrected release is published
• Add file-type sandboxing for any 3D mesh import pipelines