CVE-2024-23948: Libigl Buffer Overflow Vulnerability

CVE-2024-23948 Overview

CVE-2024-23948 affects the readMSH functionality of libigl v2.5.0, a C++ geometry processing library. The vulnerability stems from multiple improper array index validation issues in the igl::MshLoader::parse_nodes function while handling ASCII .msh files. A specially crafted .msh file triggers an out-of-bounds write, allowing attackers to corrupt memory beyond the bounds of an allocated buffer. Exploitation requires the victim to open or process a malicious mesh file, making this relevant to any application or pipeline that ingests untrusted .msh content using libigl.

Critical Impact

Out-of-bounds write in igl::MshLoader::parse_nodes can lead to memory corruption and potential code execution when processing a malicious .msh file.

Affected Products

• libigl v2.5.0
• Applications statically linking libigl 2.5.0
• Geometry processing pipelines using libigl readMSH on untrusted input

Discovery Timeline

• 2024-05-28 - CVE-2024-23948 published to NVD
• 2025-02-12 - Last updated in NVD database
• Reported via Talos Intelligence Vulnerability Report TALOS-2024-1926

Technical Details for CVE-2024-23948

Vulnerability Analysis

The vulnerability resides in igl::MshLoader::parse_nodes, which parses node data from ASCII .msh mesh files. The parser reads index values from the input file and uses them to index into internal arrays without validating that the indices fall within allocated bounds. When the supplied index exceeds the buffer size, the function writes attacker-controlled data past the end of the allocation. This pattern is classified under CWE-787 (Out-of-Bounds Write).

Because libigl is commonly embedded into desktop tools, research pipelines, and 3D content workflows, the vulnerability extends the attack surface of any product that loads third-party .msh files.

Root Cause

The root cause is missing or insufficient validation of indices parsed from the .msh file before they are used as array offsets inside parse_nodes. The function trusts file-supplied counts and indices, allowing crafted values to direct writes outside the legitimate buffer range.

Attack Vector

An attacker crafts a malicious .msh file containing manipulated node index or count fields and delivers it to a victim through email, a shared repository, a web download, or a model marketplace. When the victim opens the file in an application that uses libigl's readMSH, the parser performs an out-of-bounds write. The vulnerability requires user interaction to open or import the file.

No public proof-of-concept exploit is currently available. Technical details are documented in the Talos Intelligence Vulnerability Report.

Detection Methods for CVE-2024-23948

Indicators of Compromise

• Crash or abnormal termination of processes that load .msh files via libigl
• .msh files received from untrusted sources with unusually large or inconsistent node count headers
• Unexpected child process creation following the parsing of a mesh file

Detection Strategies

• Inventory applications and build artifacts that statically or dynamically link libigl 2.5.0 across developer and engineering systems.
• Monitor process telemetry for crashes, exception events, or memory access violations in processes that handle .msh content.
• Apply YARA or content rules to flag .msh files where declared node counts diverge from file structure.

Monitoring Recommendations

• Log file open and parsing events for engineering workstations that process external mesh assets.
• Alert on segmentation faults and access violations correlated with mesh-processing binaries.
• Track inbound .msh files arriving through email gateways, collaboration platforms, and code repositories.

How to Mitigate CVE-2024-23948

Immediate Actions Required

• Identify all internal applications and dependencies using libigl 2.5.0 in source or binary form.
• Restrict processing of .msh files to trusted sources until libigl is updated.
• Run mesh-processing tooling under reduced privileges and within sandboxed environments where feasible.

Patch Information

At the time of publication, refer to the libigl repository and the Talos Intelligence Vulnerability Report TALOS-2024-1926 for the latest fix availability and remediation guidance. Upgrade to a version of libigl that addresses the parse_nodes index validation issue once released, and rebuild downstream applications against the patched library.

Workarounds

• Disable or remove .msh ingestion paths in applications that do not require Gmsh format support.
• Validate .msh files with a hardened pre-parser that checks declared node counts against actual file size before passing them to libigl.
• Isolate mesh-processing workflows on dedicated systems or containers that limit blast radius if memory corruption occurs.