RPly CVE-2026-115722

Exploitation requires that an application using RPly (≤1.1.4) parse an attacker-controlled PLY file; the crafted file must declare a list property that specifies 'list' itself as the list's length type or value type, which causes ply_read_header_property() to accept it and ply_read_list_property() to call an out-of-bounds handler. The key LIMITING factors: delivery is local and requires victim-side processing of the malicious file (AV:L, UI:P) - there is no remote network trigger - so exploitation depends on getting the victim or a service to ingest the crafted PLY. The ASCII parsing path yields a crash (denial of service); the memory-corruption outcome is specific to the binary parsing path. No authentication is required of the attacker (PR:N), but the attacker does not act directly against a service - they supply input.

This is a genuine but moderate-priority issue rather than an urgent emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, score 6.9 Medium) frames it as a locally-delivered, low-complexity flaw requiring passive user interaction - i.e. a victim application or user must process an attacker-supplied PLY file. There is no CISA KEV listing and no EPSS score in the supplied data, so there is no evidence of active or widespread exploitation; the signals point to a parser bug triggered by malicious input rather than a remotely automatable mass-exploitation target. The vuln.today decision label is 'this_month' (not act_now/emergency), which is consistent with the Medium severity and absence of KEV. Impact is primarily availability (VA:H - crashes) with limited integrity impact (VI:L - memory corruption in the binary path) and no confidentiality impact (VC:N). The description notes memory corruption in binary parsing, which could in principle be more serious than a crash, but the supplied evidence does not confirm code execution, so this should not be assumed. Reported by VulnCheck with a dedicated advisory and a technical write-up, indicating credible sourcing. EPSS and KEV are MISSING from the input - their absence is not itself a risk signal but limits confidence in estimating real-world exploitation likelihood.

An attacker crafts a malicious PLY 3D-model file whose header declares a list property using 'list' as its length or value type. When a victim application built on RPly parses this file, ply_read_list_property() indexes an out-of-bounds handler, crashing the ASCII parser or corrupting memory in the binary parser. A public PoC reference exists (VulnCheck advisory and a hackmd write-up); it is not verified as working exploit code.