CVE-2024-24685

What it actually does

The flaw permits a stack-based buffer overflow during parsing of comments inside the vertex section of a crafted .off file by the readOFF function in libigl.

Why it matters to the business

Attackers could execute arbitrary code or crash applications that process untrusted 3D model files, resulting in potential system compromise or operational disruption.

How an attack unfolds

An attacker creates a malicious .off file containing oversized comments in the vertex section and supplies it to an application that invokes libigl's readOFF function, triggering the overflow to gain code execution.

How to fix it

Upgrade libigl to a patched version that properly bounds comment parsing within readOFF.

How to confirm the fix worked

Reproduce the vulnerability with known-malicious .off test files before and after the upgrade to confirm the overflow is eliminated.

Typical attack path

1. Craft a malicious .off file with oversized comments in the vertex section
2. Deliver the file to a target system or user
3. Trigger processing of the file via the readOFF function
4. Exploit the resulting stack overflow for code execution or denial of service

How to detect it

Monitor application logs and crash reports for abnormal behavior or segmentation faults during .off file processing with libigl.

What your security team should do

• Apply the libigl security update as soon as a fixed release is available
• Restrict processing of untrusted .off files in applications that depend on libigl
• Add runtime bounds checking or sandboxing around 3D file parsers