EUVD-2025-210858
GHSA-gg9p-3jmx-h6rw
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:L because exploitation requires processing a malicious geometry file; UI:R for the file-open interaction; C:N and I:N as process crash is the sole confirmed impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
CDT before 1.4.5 contains an out-of-bounds read vulnerability in the opposedVertexInd() function when constraint edge intersections are computed in floating point and round outside adjacent triangles. Attackers can supply nearly-degenerate constraint edges through geometry data to trigger an out-of-bounds array access that crashes the calling process.
AnalysisAI
Out-of-bounds read in CDT (Constrained Delaunay Triangulation) before 1.4.5 crashes any application that passes attacker-supplied geometry data through the library's constraint-edge insertion path. When nearly-degenerate constraint edges are provided, floating-point rounding during intersection computation places a split vertex outside the adjacent triangles, causing opposedVertexInd() to perform an unchecked out-of-bounds array access. No public exploit has been identified at time of analysis; a vendor-released patch is available in version 1.4.5.
Technical ContextAI
CDT is an open-source C++ header-only library (CPE: cpe:2.3:a:artem-ogre:cdt) implementing constrained Delaunay triangulation, widely used in mesh generation, game physics engines, GIS tooling, and computational geometry pipelines. The root cause (CWE-125, Out-of-bounds Read) is in the constraint-edge insertion walk: intersections between crossing constraint edges are computed in floating-point arithmetic, which can round the resulting split-vertex position to a location that lies outside the two triangles sharing the edge being split. The library then calls opposedVertexInd() with this geometrically invalid position, which performs an unchecked array index lookup using the bogus result, causing an out-of-bounds memory read and process crash. The vulnerable site is CDT/include/CDTUtils.hpp line 175 (tag 1.4.4). The fix in commit bf0d11e (released as 1.4.5) adds isEdgeSplitVertexValid(), which uses robust geometric predicates to verify the split vertex lies within the adjacent triangles before any index lookup, and replaces the raw triangles[iTopo] access with a bounds-checked triangleAt() wrapper that throws CDT::Error instead of accessing out-of-range memory.
RemediationAI
Upgrade to CDT version 1.4.5, released at https://github.com/artem-ogre/CDT/releases/tag/1.4.5. The fix is contained in commit bf0d11e (https://github.com/artem-ogre/CDT/commit/bf0d11ebfe3da0da72aed91816f665aef1b447cc), which adds geometric validation of computed split vertices and replaces unchecked triangle-array access with a throwing bounds-checked wrapper. For applications unable to upgrade immediately, the most effective workaround is to pre-validate all incoming constraint-edge geometry at the application boundary - rejecting edges that are nearly collinear, nearly coincident, or otherwise degenerate before they reach CDT. This requires application-level geometric sanity checks and may not intercept all floating-point rounding edge cases, so it is a temporary measure only. Sandboxing the triangulation process (e.g., running it in a subprocess) can limit crash impact to the subprocess rather than the main service.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today