EUVD-2025-19130
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
4DescriptionNVD
vkoskiv c-ray 1.1 contains a Null Pointer Dereference (NPD) vulnerability in the parse_mtllib function of its data processing module, leading to unpredictable program behavior, causing segmentation faults, and program crashes.
AnalysisAI
CVE-2025-45332 is a Null Pointer Dereference vulnerability in vkoskiv c-ray 1.1's parse_mtllib function that causes segmentation faults and program crashes. While the CVSS score of 7.5 indicates high severity, the vulnerability results in Availability impact only (crashes) with no confidentiality or integrity compromise, making it primarily a denial-of-service risk rather than an exploitable code execution vulnerability. The network-accessible attack vector (AV:N) and lack of privilege requirements (PR:N) mean remote attackers can trigger crashes without authentication.
Technical ContextAI
C-ray is a ray-tracing renderer that processes material library files (.mtl format) through the parse_mtllib function. The vulnerability stems from CWE-476 (Null Pointer Dereference), a memory safety defect where the application dereferences a null pointer without proper validation. The parse_mtllib function likely fails to validate pointers returned from memory allocation, string parsing, or file I/O operations before dereferencing them. This is typical in C-based graphics processing tools that handle external file formats. The affected component processes Material Template Library files, which are text-based format specifications commonly used in 3D graphics workflows alongside OBJ model files.
RemediationAI
monitor the official c-ray repository (https://github.com/vkoskiv/c-ray) for security updates or contact the maintainer directly.; priority: High
Share
External POC / Exploit Code
Leaving vuln.today