EUVD-2026-42727
GHSA-35hq-6xqg-g3wv
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only exploitation requiring low privileges to supply a crafted FBX file; only availability is impacted at low severity with no scope change or confidentiality/integrity consequence.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was detected in lo48576 fbxcel up to 0.9.0. This affects an unknown part of the file src/pull_parser/v7400/parser.rs of the component Node Header Handler. The manipulation results in denial of service. The attack must be initiated from a local position. The exploit is now public and may be used. The pull request to fix this issue awaits acceptance.
AnalysisAI
Denial-of-service in fbxcel up to 0.9.0 allows a local, low-privileged attacker to crash any application embedding this Rust FBX-parsing library by supplying a crafted FBX file that triggers improper resource handling in the v7400 Node Header Handler. Impact is limited to availability with no confidentiality or integrity consequence, consistent with the CVSS 4.0 base score of 1.9. A public proof-of-concept exists (CVSS 4.0 E:P), though exploitation is constrained entirely to local access paths; no KEV listing or active exploitation has been reported.
Technical ContextAI
fbxcel is a Rust library authored by lo48576 for reading binary FBX (Filmbox) files, a 3D scene interchange format used by Autodesk and related tooling. The affected code resides in src/pull_parser/v7400/parser.rs within the Node Header Handler of the v7400 pull parser. CWE-404 (Improper Resource Shutdown or Release) indicates the parser fails to properly close or release internal resources when encountering malformed node header data, leading to an uncontrolled application termination or resource exhaustion. No CPE string was supplied in the input data, so affected package coordinates are identified solely from the GitHub repository at https://github.com/lo48576/fbxcel/ and the CVE description stating versions up to 0.9.0.
RemediationAI
No vendor-released patched version has been confirmed at time of analysis. A fix is proposed in pull request #15 at https://github.com/lo48576/fbxcel/pull/15, which awaits upstream acceptance and has not yet been merged into a tagged release. Consumers of fbxcel should monitor the repository for merge of PR #15 and update to the subsequent release once available. As a compensating control in the interim, applications should avoid processing untrusted or externally supplied FBX files until a patched version ships. If fbxcel is used in a file-processing pipeline that must accept external input, consider isolating the parser in a sandboxed subprocess so that a crash caused by malformed input does not propagate to the broader application. This sandboxing adds process-spawn overhead but limits the blast radius of the denial-of-service condition.
Same weakness CWE-404 – Improper Resource Shutdown or Release
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today