What’s Vulnerable › Vulnerabilities

CVE-2020-28601

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-03-04 · updated 2026-06-17
• Weakness: CWE-129

Description

A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in Nef_2/PM_io_parser.h PM_io_parser::read_vertex() Face_of[] OOB read. An attacker can provide malicious input to trigger this vulnerability.

Affected products

• Cgal Computational Geometry Algorithms Library: 5.1.1
• Debian Linux: 9.0, 10.0
• Fedoraproject Fedora: 33, 34

References

• https://lists.debian.org/debian-lts-announce/2021/05/msg00002.html
• https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E4J344OKKDLPRN422OYRR46HDEN6MM6P/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NB5SF5OJR2DSV7CC6U7FVW5VJSJO5EKV/
• https://security.gentoo.org/glsa/202305-34
• https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225
• https://lists.debian.org/debian-lts-announce/2021/05/msg00002.html
• https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E4J344OKKDLPRN422OYRR46HDEN6MM6P/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NB5SF5OJR2DSV7CC6U7FVW5VJSJO5EKV/
• https://security.gentoo.org/glsa/202305-34
• https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225

Get alerted when CVE-2020-28601 or the next vulnerability affects your stack