CVE-2026-115722 Details
Description
RPly through 1.1.4 contains an improper array index validation vulnerability in ply_read_header_property() that accepts list as a list property's length or value type. Attackers can supply a crafted PLY file that makes ply_read_list_property() call an out-of-bounds handler, crashing ASCII parsing or corrupting memory in binary parsing.
A vulnerability exists in RPly versions through 1.1.4, where the PLY reader improperly validates array indices for list properties in the header. This flaw allows attackers to craft PLY files that exploit the parsing functions, causing out-of-bounds accesses. The vulnerability can lead to crashes during ASCII file parsing or memory corruption when handling binary files.
To address this vulnerability, RPly should implement proper validation checks for list property types in the header parser. Specifically, the library should reject length and value types that are 'PLY_LIST' or greater, aligning the read path's validation with the existing safeguards in the write path.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 23, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@haindpwn/rply-property-list-type-confusion | CISA-ADP | ExploitTechnical Analysis |
| https://github.com/diegonehab/rply/blob/75639e3f12755ca64559d45a4a0bcffc52e04ef8/rply.c#L1228-L1251 | [email protected] | Source CodeVendor |
| https://github.com/diegonehab/rply/blob/75639e3f12755ca64559d45a4a0bcffc52e04ef8/rply.c#L821-L848 | [email protected] | Source CodeVendor |
| https://github.com/diegonehab/rply/issues/10 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://hackmd.io/@haindpwn/rply-property-list-type-confusion | [email protected] | ExploitTechnical Analysis |
| https://www.vulncheck.com/advisories/rply-through-1.1.4-out-of-bounds-function-pointer-index-via-ply-header | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-129 | Improper Validation of Array Index | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| diegonehab RPly | <= 1.1.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 23, 2026 | New CVE Received | [email protected] |