Cgns
Monthly
Parsing a crafted ADF node header in CGNS through 4.5.2 triggers a stack out-of-bounds read that can crash downstream tools such as cgnslist, giving an attacker a local denial-of-service against the parsing application. The flaw lives in ADFI_read_node_header (src/adf/ADF_internals.c), where an end tag that is not NUL-terminated causes ADFI_stridx_c to scan past the disk_node_data buffer. Publicly available exploit code exists (a HackMD proof-of-concept write-up referenced in the CVE record), but there is no confirmed active exploitation per CISA KEV, and there is no remote or network-triggered path: the victim must locally open an attacker-supplied .cgns or .adf file, and the worst outcome is a process crash with no code execution, data disclosure, or integrity loss.
Parsing a crafted ADF node header in CGNS through 4.5.2 triggers a stack out-of-bounds read that can crash downstream tools such as cgnslist, giving an attacker a local denial-of-service against the parsing application. The flaw lives in ADFI_read_node_header (src/adf/ADF_internals.c), where an end tag that is not NUL-terminated causes ADFI_stridx_c to scan past the disk_node_data buffer. Publicly available exploit code exists (a HackMD proof-of-concept write-up referenced in the CVE record), but there is no confirmed active exploitation per CISA KEV, and there is no remote or network-triggered path: the victim must locally open an attacker-supplied .cgns or .adf file, and the worst outcome is a process crash with no code execution, data disclosure, or integrity loss.