CVE-2024-24684 - Vulnerability Details - OpenCVE

Multiple stack-based buffer overflow vulnerabilities exist in the readOFF functionality of libigl v2.5.0. A specially crafted .off file can lead to stack-based buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability concerns the header parsing occuring while processing an `.off` file via the `readOFF` function.

We can see above that at [0] a stack-based buffer called `comment` is defined with an hardcoded size of `1000 bytes`. The call to `fscanf` at [1] is unsafe and if the first line of the header of the `.off` files is longer than 1000 bytes it will overflow the `header` buffer.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.21925.

Key SSVC decision points have not yet been added.

Vendors	Products
Libigl	Libigl

Configuration 1 [-]

cpe:2.3:a:libigl:libigl:2.5.0:*:*:*:*:*:*:*

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://talosintelligence.com/vulnerability_reports/TALOS-2024-1929
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1929

History

Sun, 13 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.16142}`	epss `{'score': 0.17379}`

Wed, 12 Feb 2025 19:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Libigl Libigl libigl
Weaknesses		CWE-787
CPEs		cpe:2.3:a:libigl:libigl:2.5.0:::::::*
Vendors & Products		Libigl Libigl libigl

MITRE

Status: PUBLISHED

Assigner: talos

Published: 2024-05-28T14:02:39.939Z

Updated: 2025-02-13T17:40:18.620Z

Reserved: 2024-01-26T09:40:46.280Z

Link: CVE-2024-24684

Vulnrichment

Updated: 2024-08-01T23:28:11.102Z

NVD

Status : Analyzed

Published: 2024-05-28T14:15:11.830

Modified: 2025-02-12T19:29:16.393

Link: CVE-2024-24684

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2024-24684", "assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "state": "PUBLISHED", "assignerShortName": "talos", "dateReserved": "2024-01-26T09:40:46.280Z", "datePublished": "2024-05-28T14:02:39.939Z", "dateUpdated": "2025-02-13T17:40:18.620Z"}, "containers": {"cna": {"affected": [{"vendor": "libigl", "product": "libigl", "versions": [{"version": "v2.5.0", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "Multiple stack-based buffer overflow vulnerabilities exist in the readOFF functionality of libigl v2.5.0. A specially crafted .off file can lead to stack-based buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability concerns the header parsing occuring while processing an `.off` file via the `readOFF` function. \r\n\r\n\r\nWe can see above that at [0] a stack-based buffer called `comment` is defined with an hardcoded size of `1000 bytes`. The call to `fscanf` at [1] is unsafe and if the first line of the header of the `.off` files is longer than 1000 bytes it will overflow the `header` buffer."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-121: Stack-based Buffer Overflow", "type": "CWE", "cweId": "CWE-121"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH"}}], "providerMetadata": {"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "shortName": "talos", "dateUpdated": "2024-06-10T18:08:47.208Z"}, "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1929", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1929"}, {"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1929"}], "credits": [{"lang": "en", "value": "Discovered by Philippe Laulheret of Cisco Talos."}]}, "adp": [{"affected": [{"vendor": "libigl", "product": "libigl", "cpes": ["cpe:2.3:a:libigl:libigl:2.5.0:*:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "2.5.0", "status": "affected"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-05-28T16:24:46.778538Z", "id": "CVE-2024-24684", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-24T17:54:43.959Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:28:11.102Z"}, "title": "CVE Program Container", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1929", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1929", "tags": ["x_transferred"]}, {"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1929", "tags": ["x_transferred"]}]}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1929", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1929", "tags": ["x_transferred"]}, {"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1929", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:28:11.102Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-24684", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-28T16:24:46.778538Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:libigl:libigl:2.5.0:*:*:*:*:*:*:*"], "vendor": "libigl", "product": "libigl", "versions": [{"status": "affected", "version": "2.5.0"}], "defaultStatus": "affected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-28T16:26:05.796Z"}}], "cna": {"credits": [{"lang": "en", "value": "Discovered by Philippe Laulheret of Cisco Talos."}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "libigl", "product": "libigl", "versions": [{"status": "affected", "version": "v2.5.0"}]}], "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1929", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1929"}, {"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1929"}], "descriptions": [{"lang": "en", "value": "Multiple stack-based buffer overflow vulnerabilities exist in the readOFF functionality of libigl v2.5.0. A specially crafted .off file can lead to stack-based buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability concerns the header parsing occuring while processing an `.off` file via the `readOFF` function. \r\n\r\n\r\nWe can see above that at [0] a stack-based buffer called `comment` is defined with an hardcoded size of `1000 bytes`. The call to `fscanf` at [1] is unsafe and if the first line of the header of the `.off` files is longer than 1000 bytes it will overflow the `header` buffer."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "CWE-121: Stack-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "shortName": "talos", "dateUpdated": "2024-05-28T14:02:39.939Z"}}}, "cveMetadata": {"cveId": "CVE-2024-24684", "state": "PUBLISHED", "dateUpdated": "2024-08-01T23:28:11.102Z", "dateReserved": "2024-01-26T09:40:46.280Z", "assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "datePublished": "2024-05-28T14:02:39.939Z", "assignerShortName": "talos"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:libigl:libigl:2.5.0:*:*:*:*:*:*:*", "matchCriteriaId": "91BC184E-2C02-40C5-BA95-B2ADCF16C366", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple stack-based buffer overflow vulnerabilities exist in the readOFF functionality of libigl v2.5.0. A specially crafted .off file can lead to stack-based buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability concerns the header parsing occuring while processing an `.off` file via the `readOFF` function. \r\n\r\n\r\nWe can see above that at [0] a stack-based buffer called `comment` is defined with an hardcoded size of `1000 bytes`. The call to `fscanf` at [1] is unsafe and if the first line of the header of the `.off` files is longer than 1000 bytes it will overflow the `header` buffer."}, {"lang": "es", "value": "Existen m\u00faltiples vulnerabilidades de desbordamiento de b\u00fafer en la regi\u00f3n stack de la memoria en la funcionalidad readOFF de libigl v2.5.0. Un archivo .off especialmente manipulado puede provocar un desbordamiento de b\u00fafer en la regi\u00f3n stack de la memoria. Un atacante puede proporcionar un archivo malicioso para desencadenar esta vulnerabilidad. Esta vulnerabilidad se refiere al an\u00e1lisis del encabezado que se produce al procesar un archivo \".off\" a trav\u00e9s de la funci\u00f3n \"readOFF\". Podemos ver arriba que en [0] se define un b\u00fafer basado en pila llamado \"comentario\" con un tama\u00f1o codificado de \"1000 bytes\". La llamada a `fscanf` en [1] no es segura y si la primera l\u00ednea del encabezado de los archivos `.off` tiene m\u00e1s de 1000 bytes, desbordar\u00e1 el b\u00fafer del `header`."}], "id": "CVE-2024-24684", "lastModified": "2025-02-12T19:29:16.393", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "talos-cna@cisco.com", "type": "Secondary"}]}, "published": "2024-05-28T14:15:11.830", "references": [{"source": "talos-cna@cisco.com", "tags": ["Mitigation", "Third Party Advisory"], "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1929"}, {"source": "talos-cna@cisco.com", "tags": ["Mitigation", "Third Party Advisory"], "url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1929"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mitigation", "Third Party Advisory"], "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1929"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mitigation", "Third Party Advisory"], "url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1929"}], "sourceIdentifier": "talos-cna@cisco.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-121"}], "source": "talos-cna@cisco.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}