CVE-2025-15647: CDT Buffer Overflow Vulnerability

CVE-2025-15647 Overview

CVE-2025-15647 is an out-of-bounds read vulnerability in the Constrained Delaunay Triangulation (CDT) library before version 1.4.5. The flaw resides in the opposedVertexInd() function when constraint edge intersections are computed in floating point. Rounding errors can place the computed split vertex outside adjacent triangles, causing an out-of-bounds array access. Attackers supply nearly-degenerate constraint edges through geometry data to trigger the condition, crashing the calling process. The vulnerability is classified as [CWE-125] Out-of-Bounds Read.

Critical Impact
Attackers can crash any application embedding CDT < 1.4.5 by supplying crafted geometry input that produces unresolvable constraint edge intersections.

Affected Products

CDT (Constrained Delaunay Triangulation) library versions prior to 1.4.5
Applications embedding the CDT header-only C++ library for computational geometry
Downstream projects consuming CDTUtils.hpp from the artem-ogre/CDT repository

Discovery Timeline

2026-09-05 - CVE-2025-15647 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2025-15647

Vulnerability Analysis

CDT is a header-only C++ library for computing constrained and conforming Delaunay triangulations. When two constraint edges intersect, CDT computes a split vertex at the intersection point and inserts it into the triangulation. The opposedVertexInd() function then locates the vertex opposite a given edge within an adjacent triangle.

When the input contains nearly-degenerate or numerically ill-conditioned constraint edges, floating-point rounding can place the computed split vertex outside both adjacent triangles. The function then indexes into a triangle vertex array without finding a match, returning an invalid index that is subsequently used for array access. The result is an out-of-bounds read that crashes the calling process.

Root Cause

The root cause is missing validation of the computed split vertex position relative to the adjacent triangles of the intersecting constraint edges. The header CDT/include/CDTUtils.hpp at line 175 in version 1.4.4 implements opposedVertexInd() without handling the case where floating-point rounding produces a vertex outside the expected triangles. No exception is raised, so execution proceeds with an invalid vertex index.

Attack Vector

Exploitation requires local delivery of crafted geometry input to an application that calls CDT's constraint edge intersection routines. An attacker prepares a mesh containing nearly-degenerate constraint edges whose intersection cannot be resolved cleanly in floating point. User interaction is required to load the malicious geometry file. Successful exploitation crashes the host process, producing a denial-of-service condition. There is no confidentiality or integrity impact; the vulnerability affects availability only.

     Edge m_e1, m_e2;
 };
 
+/**
+ * Error thrown when resolving intersecting constraints fails: floating-point
+ * rounding places the computed split vertex outside the edge's adjacent
+ * triangles, so it can not be inserted
+ */
+class InvalidEdgeSplitVertex : public Error
+{
+public:
+    /// Constructor
+    InvalidEdgeSplitVertex(
+        const Edge& e1,
+        const Edge& e2,
+        const SourceLocation& srcLoc)
+        : Error(
+              "Intersection of constraint edges (" + CDT::to_string(e1.v1()) +
+                  ", " + CDT::to_string(e1.v2()) + ") can not be resolved: computed split vertex is invalid",
+              srcLoc)
+        , m_e1(e1)
+        , m_e2(e2)
+    {}
+    const Edge& e1() const { return m_e1; }
};
// Source: [GitHub CDT Commit bf0d11e](https://github.com/artem-ogre/CDT/commit/bf0d11ebfe3da0da72aed91816f665aef1b447cc)

The patch introduces an InvalidEdgeSplitVertex exception class that is thrown when the computed split vertex falls outside adjacent triangles, replacing the silent out-of-bounds access with a catchable error.

Detection Methods for CVE-2025-15647

Indicators of Compromise

Unexpected termination or segmentation faults in processes that load third-party geometry files and link against CDT < 1.4.5.
Crash dumps referencing opposedVertexInd() or nearby symbols in CDTUtils.hpp.
Geometry input files containing coincident or nearly-collinear constraint edges that produce unresolvable intersections.

Detection Strategies

Perform software composition analysis (SCA) on C++ codebases to identify use of the artem-ogre/CDT library and flag versions earlier than 1.4.5.
Fuzz test applications that ingest external geometry data with malformed and degenerate constraint edges to reproduce the crash.
Monitor application telemetry for repeated crash signatures originating from triangulation routines after opening user-supplied files.

Monitoring Recommendations

Enable operating system crash reporting (Windows Error Reporting, systemd-coredump, or macOS CrashReporter) and centralize dumps for triage.
Correlate application crashes with recent file-open events involving mesh, CAD, or GIS payloads.
Track SBOM data for downstream products bundling CDT to accelerate identification of vulnerable deployments.

How to Mitigate CVE-2025-15647

Immediate Actions Required

Upgrade the CDT library to version 1.4.5 or later in all affected projects and rebuild dependent binaries.
Audit application dependency manifests, submodules, and vendored copies of CDTUtils.hpp to ensure the patched version is used everywhere.
Restrict processing of untrusted geometry files until patched binaries are deployed.

Patch Information

The fix is included in CDT Release 1.4.5 and is tracked in GitHub issue #212. The corrective change is available in commit bf0d11e, which introduces the InvalidEdgeSplitVertex exception. Additional context is provided in the VulnCheck advisory.

Workarounds

Wrap calls to CDT triangulation routines in exception handlers and isolate them in a separate process or worker to contain crashes.
Pre-validate input geometry to reject coincident vertices and near-collinear constraint edges before passing them to CDT.
Sandbox applications that must process untrusted geometry data using OS-level isolation such as containers, seccomp, or AppContainer.

bash

# Update to the patched CDT release
cd third_party/CDT
git fetch --tags
git checkout 1.4.5
cd ../.. && cmake --build build --target clean && cmake --build build