CVE-2024-24686: Libigl Buffer Overflow Vulnerability

CVE-2024-24686 Overview

CVE-2024-24686 is a stack-based buffer overflow vulnerability in the readOFF functionality of libigl v2.5.0. The flaw resides in the parser that processes comments within the faces section of .off geometry files. An attacker who convinces a user to open a specially crafted .off file can trigger memory corruption on the stack, leading to code execution in the context of the application linking libigl.

libigl is a widely used C++ geometry processing library embedded in 3D modeling, mesh processing, and scientific computing applications. Applications that ingest untrusted .off files through libigl inherit this vulnerability.

Critical Impact
A malicious .off file processed by readOFF can corrupt the stack and enable arbitrary code execution with the privileges of the host application.

Affected Products

libigl version 2.5.0
Applications and toolchains that link libigl 2.5.0 and expose readOFF to user-supplied input
Downstream geometry processing pipelines that ingest untrusted .off mesh files

Discovery Timeline

2024-05-28 - CVE-2024-24686 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-24686

Vulnerability Analysis

The .off (Object File Format) file format encodes 3D mesh geometry as a header, followed by vertex coordinates and face definitions. libigl's readOFF function parses these sections sequentially. Within the faces section, the parser supports inline comments, and the routine handling those comments writes data into a fixed-size stack buffer without validating the input length.

When a crafted .off file supplies an oversized comment inside the faces section, the copy operation overruns the buffer and overwrites adjacent stack memory. This corruption can overwrite the saved return address or stack canary state, giving an attacker control over program flow. The condition is classified under [CWE-121] Stack-based Buffer Overflow and [CWE-787] Out-of-bounds Write.

Root Cause

The root cause is missing bounds checking on comment content parsed from the faces section of an .off file. The parser assumes comment lines fit within a compile-time buffer and performs an unchecked copy. Any input longer than the destination buffer overflows into neighboring stack frames.

Attack Vector

Exploitation requires local access and user interaction. An attacker delivers a malicious .off file through email, a download, or a shared repository. When the victim opens the file in an application that uses libigl 2.5.0's readOFF, the parser processes the crafted comment and triggers the overflow. Successful exploitation yields code execution at the privilege level of the parsing process. Refer to the Talos Intelligence Vulnerability Report for detailed reproduction steps.

Detection Methods for CVE-2024-24686

Indicators of Compromise

Unexpected crashes, segmentation faults, or stack canary aborts in processes that load .off files through libigl
.off files containing abnormally long comment strings within the faces section
Child process creation or shell activity spawned from geometry processing or CAD applications
Anomalous outbound network connections initiated by mesh viewer or modeling tools after opening a file

Detection Strategies

Inspect .off files at ingress with YARA or content rules that flag oversized comment tokens in the faces section
Monitor endpoint telemetry for process crashes referencing readOFF or libigl frames in stack traces
Correlate file-open events on .off files with subsequent process anomalies such as memory violations or unexpected child processes

Monitoring Recommendations

Enable Address Sanitizer (ASan) or equivalent runtime memory checkers in development and QA builds that exercise readOFF
Log and alert on Windows Error Reporting or Linux core dumps from applications embedding libigl
Track file provenance for .off inputs, flagging files sourced from external or untrusted origins

How to Mitigate CVE-2024-24686

Immediate Actions Required

Inventory all internal tools, plugins, and third-party applications that link libigl and identify those pinned to version 2.5.0
Restrict opening .off files to trusted sources until a patched libigl release is deployed
Isolate systems that routinely process externally supplied mesh files, and run parsing workflows under least-privilege accounts

Patch Information

No vendor-supplied patched version is referenced in the NVD entry at the time of publication. Consult the Talos Intelligence Vulnerability Report and the upstream libigl repository for the current fix status and to obtain a build that addresses the readOFF comment parser.

Workarounds

Avoid using readOFF on untrusted .off files and pre-filter inputs with a validated parser that rejects malformed comment tokens
Sandbox mesh parsing in a separate low-privilege process, container, or virtual machine to contain any successful exploitation
Compile applications embedding libigl with stack protection flags such as -fstack-protector-strong, -D_FORTIFY_SOURCE=2, and position-independent executables

bash

# Example hardening flags for applications embedding libigl
CFLAGS="-fstack-protector-strong -D_FORTIFY_SOURCE=2 -fPIE -O2"
LDFLAGS="-Wl,-z,relro -Wl,-z,now -pie"
cmake -DCMAKE_C_FLAGS="$CFLAGS" -DCMAKE_EXE_LINKER_FLAGS="$LDFLAGS" ..