LiveActive security incident?Get immediate response
CVE Record

CVE-2020-28608: Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGA...

Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_2/PM_io_parser.h PM_io_parser<PMDEC>::read_face() store_fc().

CriticalCVSS 10Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

CGAL libcgal 5.1.1 has critical flaws in Nef polygon file parsing. A malformed geometry file can corrupt parser behavior and may allow code execution. The highest concern is systems that automatically process untrusted geometry or polygon files, especially exposed services or batch pipelines.

Executive priority

Treat as urgent for systems that process external geometry files. Prioritize patching exposed or automated parsing services first, then internal tools and developer workstations using affected libcgal packages.

Technical view

The vulnerability is in Nef_2/PM_io_parser.h, specifically PM_io_parser<PMDEC>::read_face() and store_fc(). Sources describe an out-of-bounds read and type confusion caused by malformed input, categorized as CWE-129, with CVSS 3.0 score 10.0.

Likely exposure

Exposure is likely where CGAL libcgal 5.1.1 is embedded in applications that parse attacker-supplied Nef polygon or geometry files. The bundle does not identify downstream products beyond libcgal.

Exploitation context

Sources say an attacker can provide malicious input to trigger the flaw. The bundle does not cite public exploitation, and KEV is false, so active exploitation is not established here.

Researcher notes

Do not assume broad product exposure without dependency evidence. Validate actual parser reachability, file origin, process privileges, and sandboxing. The sources support code-execution impact, but not observed exploitation.

Mitigation direction

  • Identify and update affected CGAL libcgal 5.1.1 installations.
  • Apply relevant Debian, Gentoo, or vendor security updates.
  • Restrict parsing of untrusted Nef polygon files until patched.
  • Isolate geometry parsing workloads from sensitive systems.
  • Check CGAL and distribution guidance for supported fixed versions.

Validation and detection

  • Inventory packages and SBOMs for CGAL libcgal 5.1.1.
  • Find applications using CGAL Nef polygon parsing paths.
  • Review upload, import, and batch-processing features for untrusted geometry files.
  • Confirm patched distribution packages are installed.
  • Check logs for crashes during geometry file parsing.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-129: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2020-28608 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
10 (3.0)
Known Exploited
No
Published

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
10CVSS 3.0CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H3.96Primary CVE score

Vulnerability scoring details

Base CVSS 3.0 score

10Critical
CVSS 3.0 vector shape for CVE-2020-28608Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
CGAL ProjectlibcgalCGAL-5.1.1Listed
Weakness

CWE details

CWE-129

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.