CVE-2025-8854

bullet3 VHACD utility: stack-based buffer overflow in OFF parser (LoadOFF)

CVSS 8.4 HIGHEPSS 0.5%CWE-120

Vexday Risk Score

21Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 8.4EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

11 ago 2025Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

Stack-based buffer overflow in LoadOFF in bulletphysics bullet3 before 3.26 on all platforms allows remote attackers to execute arbitrary code via a crafted OFF file with an overlong initial token processed by the VHACD test utility or invoked indirectly through PyBullet's vhacd function.

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Productos afectados

bulletphysics · bullet3

Referencias

https://github.com/bulletphysics/bullet3/blob/master/Extras/VHACD/test/src/main_vhacd.cpp#L472 https://github.com/bulletphysics/bullet3/issues/4732