CVE-2026-2653: ADMesh Buffer Overflow Vulnerability

CVE-2026-2653 Overview

A heap-based buffer overflow vulnerability has been discovered in ADMesh, an open-source library and command-line tool for manipulating STL (Stereolithography) mesh files. The flaw exists in the stl_check_normal_vector function within the src/normals.c file, affecting versions up to and including 0.98.5. Successful exploitation of this vulnerability requires local access and could allow an attacker to corrupt heap memory, potentially leading to application crashes or arbitrary code execution.

Critical Impact

This heap-based buffer overflow vulnerability in ADMesh could be exploited by local attackers to corrupt memory and potentially execute arbitrary code. The exploit has been publicly released, and the product appears to be unmaintained, increasing the risk for organizations still using this software.

Affected Products

• ADMesh versions up to and including 0.98.5
• Applications and systems that integrate ADMesh library for STL file processing
• 3D printing and CAD/CAM workflows utilizing ADMesh

Discovery Timeline

• 2026-02-18 - CVE-2026-2653 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-2653

Vulnerability Analysis

This vulnerability is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The flaw resides in the stl_check_normal_vector function in src/normals.c, which processes normal vector data during STL file operations. When handling specially crafted input, the function fails to properly validate buffer boundaries, allowing heap memory to be overwritten beyond allocated bounds.

The vulnerability requires local access for exploitation, meaning an attacker needs to either have direct access to the system or convince a user to process a malicious STL file. The public disclosure of this vulnerability, combined with the apparent lack of maintenance for the ADMesh project, creates a concerning situation for users who depend on this software for 3D mesh processing workflows.

Root Cause

The root cause of this vulnerability is insufficient boundary checking in the stl_check_normal_vector function when processing normal vector calculations for STL mesh data. The function does not adequately validate array indices or buffer sizes before performing write operations, allowing memory corruption when processing malformed input. This is a classic example of unsafe memory handling in C code where bounds validation is left to the developer rather than enforced by the language.

Attack Vector

The attack vector is local, requiring the attacker to either have direct access to the system or to craft a malicious STL file that triggers the vulnerability when processed by ADMesh. The vulnerability can be triggered through manipulation of input data that causes the stl_check_normal_vector function to write beyond the allocated heap buffer.

The vulnerability manifests when ADMesh processes specially crafted STL files containing malformed normal vector data. When the stl_check_normal_vector function in src/normals.c processes this data, improper boundary validation allows heap memory corruption. Researchers have documented this issue in GitHub Issue #65, which includes technical details and a proof-of-concept file for reproduction. The VulDB entry provides additional vulnerability intelligence.

Detection Methods for CVE-2026-2653

Indicators of Compromise

• Unexpected crashes or segmentation faults when ADMesh processes STL files
• Memory corruption errors in application logs related to ADMesh operations
• Presence of suspicious or unexpectedly large STL files in processing directories
• Abnormal memory usage patterns when ADMesh is invoked

Detection Strategies

• Monitor process execution for ADMesh (admesh binary) and log all file arguments passed to it
• Implement file integrity monitoring on directories where STL files are stored and processed
• Deploy endpoint detection to identify heap corruption or buffer overflow attempts
• Review application logs for abnormal termination of ADMesh-related processes

Monitoring Recommendations

• Enable enhanced logging for applications that integrate with ADMesh library
• Monitor for suspicious STL file uploads or transfers to systems running ADMesh
• Set up alerts for repeated crashes of processes utilizing ADMesh functionality
• Implement memory protection features (ASLR, DEP) and monitor for bypass attempts

How to Mitigate CVE-2026-2653

Immediate Actions Required

• Audit systems and applications to identify all instances of ADMesh usage
• Restrict access to ADMesh processing to trusted users and automated workflows only
• Implement strict input validation on all STL files before processing with ADMesh
• Consider migrating to actively maintained alternative STL processing libraries

Patch Information

As of the last NVD update on 2026-02-18, no official patch has been released for this vulnerability. The ADMesh project appears to be unmaintained based on the CVE description. Users are advised to monitor the ADMesh GitHub repository for any potential community-contributed fixes or to evaluate alternative software solutions. The GitHub Issue #65 contains additional technical discussion regarding this vulnerability.

Workarounds

• Isolate ADMesh operations within sandboxed or containerized environments to limit potential impact
• Implement strict file validation and sanitization for all STL files before processing
• Run ADMesh processes with minimal privileges using principle of least privilege
• Consider using alternative, actively maintained STL processing tools such as OpenSCAD or MeshLab for critical operations

# Configuration example: Run ADMesh in restricted sandbox environment
# Create dedicated user with minimal privileges
useradd -r -s /bin/false admesh_user

# Run ADMesh in sandboxed environment with limited permissions
firejail --private --net=none --noprofile \
  sudo -u admesh_user admesh input.stl -o output.stl

# Alternative: Use Docker container isolation
docker run --rm --read-only -v /data/input:/input:ro -v /data/output:/output \
  admesh-container admesh /input/file.stl -o /output/result.stl