CVE-2024-23949: Libigl Buffer Overflow Vulnerability

CVE-2024-23949 Overview

CVE-2024-23949 is an out-of-bounds write vulnerability in libigl v2.5.0, a C++ geometry processing library. The flaw resides in the readMSH functionality, specifically within the igl::MshLoader::parse_node_field function when handling ASCII .msh files. A specially crafted .msh file triggers improper array index validation, enabling memory corruption outside intended buffer bounds. An attacker who convinces a user to open a malicious .msh file can achieve out-of-bounds memory writes, potentially leading to arbitrary code execution within the context of the process consuming the file.

Critical Impact
Processing a malicious .msh file can corrupt process memory and lead to code execution with the privileges of the affected application.

Affected Products

libigl v2.5.0
Applications embedding libigl for mesh import operations
Workflows that parse untrusted ASCII .msh files via igl::MshLoader

Discovery Timeline

2024-05-28 - CVE-2024-23949 published to the National Vulnerability Database (NVD)
2025-02-12 - Last updated in NVD database

Technical Details for CVE-2024-23949

Vulnerability Analysis

The vulnerability is classified under [CWE-787] Out-of-Bounds Write. It exists in the igl::MshLoader::parse_node_field function inside libigl v2.5.0. The advisory describes multiple improper array index validation issues in the readMSH functionality. When the loader parses node field metadata from an ASCII .msh file, attacker-controlled values are used as array indices without sufficient bounds checking.

Writing outside the allocated buffer corrupts adjacent heap or stack memory. Depending on the surrounding allocator state and target binary, this corruption can be steered toward control-flow hijacking. The vulnerability requires user interaction, since the victim must open the crafted file in an application that uses libigl to parse the mesh.

Root Cause

The root cause is missing validation of array indices derived from file content during ASCII .msh parsing. The parse_node_field routine trusts size and index fields encoded in the input without validating them against the destination buffer size. This violates the principle of treating all parsed external data as untrusted before indexed memory operations.

Attack Vector

An attacker delivers a malicious .msh file via email, web download, shared storage, or a project repository. When the victim loads the file in an application linking libigl, parsing reaches igl::MshLoader::parse_node_field. Crafted index or size fields drive the out-of-bounds write. The network attack vector reflects remote file delivery, while user interaction is required to open the file. Refer to the Talos Intelligence Vulnerability Report TALOS-2024-1926 for the full technical write-up.

Detection Methods for CVE-2024-23949

Indicators of Compromise

Unexpected crashes or memory corruption signatures in processes that load libigl-based mesh importers
Inbound or shared .msh files originating from untrusted sources or matching known crafted samples from TALOS-2024-1926
Child processes spawned from applications that parse .msh files outside normal user workflows

Detection Strategies

Inventory build dependencies and identify binaries statically or dynamically linking libigl 2.5.0
Apply file-type inspection at email and web gateways to flag .msh attachments from external senders
Monitor endpoint telemetry for abnormal memory access violations in 3D modeling, CAD, or geometry processing tools

Monitoring Recommendations

Enable crash reporting and exploit mitigation telemetry (ASLR, DEP, CFG) on workstations that handle mesh files
Centralize application crash logs and correlate repeated faults in libigl symbols with file open events
Track software bill of materials (SBOM) data to detect downstream products still shipping vulnerable libigl versions

How to Mitigate CVE-2024-23949

Immediate Actions Required

Identify all internal applications and tools that bundle libigl v2.5.0 and prioritize them for update or rebuild
Restrict opening of .msh files received from untrusted sources until dependent applications are patched
Apply least privilege to user accounts that routinely process external mesh files to limit blast radius

Patch Information

At the time of last NVD update, no vendor-listed patched release is referenced in the advisory data. Monitor the libigl GitHub repository and the Talos advisory TALOS-2024-1926 for fix availability. Rebuild and redistribute any internal software that statically links libigl once a corrected version is published.

Workarounds

Disable or gate the readMSH ASCII import path in custom builds when the feature is not required
Sandbox mesh-processing applications using OS-level isolation such as containers, AppContainer, or seccomp profiles
Validate .msh files with an out-of-process scanner before passing them to applications linking libigl

bash

# Configuration example
# Block .msh attachments from external senders at the mail gateway
# (example syntax — adapt to your mail security product)
rule "block-external-msh" {
  when sender.is_external == true
  and attachment.extension == "msh"
  then action = quarantine
  notify = secops@example.com
}