CVE-2024-24684 Overview
CVE-2024-24684 is a stack-based buffer overflow vulnerability in the readOFF function of libigl v2.5.0, a C++ geometry processing library. A specially crafted .off file with a header line longer than 1000 bytes triggers memory corruption during parsing. An attacker delivers a malicious file to a user or application that processes it via readOFF, leading to arbitrary code execution in the context of the parsing process.
Critical Impact
Processing an attacker-supplied .off file causes a stack-based buffer overflow that can lead to arbitrary code execution with full confidentiality, integrity, and availability impact on the local host.
Affected Products
- libigl v2.5.0
- Applications embedding libigl geometry processing routines
- Downstream tools that call readOFF on untrusted .off input
Discovery Timeline
- 2024-05-28 - CVE-2024-24684 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-24684
Vulnerability Analysis
The flaw resides in the header-parsing logic of the readOFF function inside libigl v2.5.0. A fixed-size stack buffer named comment is declared with a hardcoded length of 1000 bytes. The parser then invokes fscanf without an explicit width specifier bounded to that buffer size. When the first header line of an .off file exceeds 1000 bytes, fscanf writes past the buffer boundary and corrupts adjacent stack memory.
The vulnerability is classified under [CWE-121: Stack-based Buffer Overflow] and [CWE-787: Out-of-bounds Write]. Successful exploitation can overwrite the saved return address, function pointers, or local variables on the stack. That primitive supports arbitrary code execution in the process that opens the malicious file.
Exploitation requires local user interaction, because the victim must load the crafted .off file into a libigl-based tool. There is no authentication requirement, and the attack complexity is low.
Root Cause
The root cause is an unbounded fscanf call reading arbitrary-length header content into a fixed 1000-byte stack buffer. The parser does not validate line length before writing. No format specifier width limits the number of characters copied.
Attack Vector
An attacker crafts an .off mesh file with an oversized first header line. The victim opens the file in an application that calls readOFF. During header parsing, the excess bytes overflow the comment buffer and overwrite stack frames belonging to the parsing routine.
Full technical analysis and reproduction details are documented in the Talos Intelligence Vulnerability Report TALOS-2024-1929.
Detection Methods for CVE-2024-24684
Indicators of Compromise
- .off files whose first header line exceeds 1000 bytes or contains non-printable payload data
- Crashes, segmentation faults, or stack canary aborts in processes that call readOFF
- Unexpected child process creation from applications that only parse geometry files
Detection Strategies
- Statically inspect binaries and dependencies for linkage against libigl v2.5.0 or vendored copies of readOFF.cpp
- Add file-format validation that rejects .off files with header lines longer than a safe threshold before invoking libigl
- Monitor endpoint telemetry for crashes in processes that parse mesh files, correlated with recent file downloads or email attachments
Monitoring Recommendations
- Alert on abnormal termination or exploit-mitigation events (stack canary, CFG, ASLR faults) in geometry-processing applications
- Track process lineage where a viewer or CAD tool spawns shells, scripting interpreters, or network utilities
- Log write access to .off files from untrusted paths such as browser download or email quarantine directories
How to Mitigate CVE-2024-24684
Immediate Actions Required
- Inventory all internal tools and third-party software that embed libigl and identify versions in use
- Block or quarantine untrusted .off files at email and web gateways until affected applications are patched
- Restrict .off file processing to sandboxed accounts with no interactive privileges
Patch Information
At the time of publication, no fixed libigl release is referenced in the NVD advisory. Consult the Talos Intelligence Vulnerability Report TALOS-2024-1929 and the libigl project repository for updates, upstream patches, and remediation guidance.
Workarounds
- Pre-validate .off files with a length-checking parser before passing them to readOFF
- Reject any .off file whose first line exceeds a conservative bound such as 512 bytes
- Run libigl-based tools inside an OS sandbox, container, or virtual machine that limits filesystem and network access
- Compile libigl consumers with stack protectors, ASLR, and non-executable stack enabled to raise exploitation cost
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
