CVE-2026-115722
Description
A flaw was found in RPly. The parser improperly validates property definitions in file headers, allowing invalid list types to trigger out-of-bounds function calls. An attacker could exploit this vulnerability by tricking a user into opening a specially crafted Polygon File Format (PLY) file. Successful exploitation could lead to memory corruption or cause an application crash, resulting in a Denial of Service (DoS).
Statement
A flaw was found in RPly through 1.1.4. The parser improperly validates list property definitions in PLY file headers: ply_read_header_property() accepts "list" as a list property's length or value type, so a crafted PLY file can make ply_read_list_property() call an out-of-bounds handler, crashing ASCII parsing or corrupting memory in binary parsing. Exploitation requires a user or application to parse an attacker-supplied crafted PLY file (user interaction required). No upstream fix is currently available; the suggested upstream patch adds PLY_LIST type validation in ply_read_header_property(), mirroring the checks already performed in ply_add_list_property().
Mitigation
Avoid opening or parsing untrusted PLY files with RPly-based applications until a fixed upstream release is available. Apply the upstream suggested patch (which adds PLY_LIST type validation in ply_read_header_property) once it is released.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
