A heap‑based buffer overflow exists in the stl_check_normal_vector function within ADMesh’s normals.c module. An attacker who can supply a crafted STL file while the program is running may overflow a memory buffer on the heap, potentially causing a crash or execution of malicious code. The flaw is triggered by local manipulation of input data and is not remotely exploitable. The underlying weaknesses correspond to CWE‑119 and CWE‑122, indicating improper bounds checking and buffer over‑run issues.

The affected product is ADMesh by the admesh_project, versions up to 0.98.5. No downstream versions are listed, and the project appears to be unmaintained. Users of older releases that still process STL files from untrusted sources are at risk.

The CVSS base score is 4.8, reflecting a moderate severity for a local exploit. The EPSS indicates a very low but nonzero probability of exploitation (<1%), and the vulnerability is not listed in CISA’s KEV catalog. Because the code must be executed locally, a privileged or locally‑logged user could exploit the flaw, but remote attackers would be unable to trigger it unless they can run the software. Publicly available proof‑of‑concept exploits suggest that the risk is real for environments that permit local execution of untrusted STL files.