{"schema":"threatline.record/2","record":{"id":"CVE-2026-115722","aliases":[],"summary":"RPly through 1.1.4 Out-of-Bounds Function Pointer Index via PLY Header","details":"RPly through 1.1.4 contains an improper array index validation vulnerability in ply_read_header_property() that accepts list as a list property's length or value type. Attackers can supply a crafted PLY file that makes ply_read_list_property() call an out-of-bounds handler, crashing ASCII parsing or corrupting memory in binary parsing.","categories":["Unclassified"],"product":"rply","vendor":"diegonehab","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115722","source_modified_at":"2026-10-23T11:36:46.355Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"rply","vendor":"diegonehab","versions":[{"lessThanOrEqual":"1.1.4","status":"affected","version":"0","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":6.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00172,"percentile":0.06265,"score_date":"2026-10-24"},"published_at":"2026-10-23T11:36:46.355Z","modified_at":"2026-10-23T11:36:46.355Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-115722","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T11:36:46.355Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115722","fetched_at":"2026-10-24T18:03:20.872036Z","source_modified_at":"2026-10-24"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/diegonehab/rply/issues/10","tags":["issue-tracking"]},{"source":"CVE List","url":"https://github.com/diegonehab/rply/blob/75639e3f12755ca64559d45a4a0bcffc52e04ef8/rply.c#L1228-L1251","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/diegonehab/rply/blob/75639e3f12755ca64559d45a4a0bcffc52e04ef8/rply.c#L821-L848","tags":["technical-description"]},{"source":"CVE List","url":"https://hackmd.io/@haindpwn/rply-property-list-type-confusion","tags":["third-party-advisory"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/rply-through-1.1.4-out-of-bounds-function-pointer-index-via-ply-header","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-23T11:36:46.355Z","content_hash":"04d8d3373224e837cd60d906240c289d3a77dbec5d77d414b1b0a0877b230ecf"}}