RPly v1.1.4 suffers from improper validation of an array index within the ply_read_header_property() routine. The flaw allows an attacker to supply a malicious PLY file that triggers an out‑of‑bounds handler in ply_read_list_property(), causing the parser to crash during ASCII processing or to corrupt heap memory when parsing binary files. The vulnerability maps to CWE‑125 and CWE‑129 and can lead to denial of service.

The issue is present in the diegonehab RPly library up to and including release 1.1.4. No other versions are listed in the CVE data, and the vulnerability has not been documented for earlier releases; however, the phrasing indicates that older versions may also be affected.

The CVSS score of 6.9 indicates a moderate severity, while the EPSS score of < 1% suggests a very low exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Attackers need to provide a crafted PLY file to the application. If the software processes untrusted PLY files—such as those uploaded by users or received from external sources—the exploitation path is straightforward: an adversary can trigger a crash or corrupt memory on the host system. Because the exploit requires only a malformed file and does not rely on elevated privileges or network connectivity, the effective attack vector is likely local or remote file processing depending on the application’s context.