CVE-2026-115722
RPly through 1.1.4 Out-of-Bounds Function Pointer Index via PLY Header
diegonehab rply
CVSS
6.9MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
RPly through 1.1.4 contains an improper array index validation vulnerability in ply_read_header_property() that accepts list as a list property's length or value type. Attackers can supply a crafted PLY file that makes ply_read_list_property() call an out-of-bounds handler, crashing ASCII parsing or corrupting memory in binary parsing.
Text from CVE List
Affected versions 1
- rplyaffected: all versions through 1.1.4CVE List
References 5
- hackmd.io/@haindpwn/rply-property-list-type-confusionAdvisoryvia CVE List
- vulncheck.com/advisories/rply-through-1.1.4-out-of-bounds-function-pointer-index-via-ply-headerAdvisoryvia CVE List
- github.com/diegonehab/rply/issues/10Referencevia CVE List
- github.com/diegonehab/rply/blob/75639e3f12755ca64559d45a4a0bcffc52e04ef8/rply.c#L1228-L1251Referencevia CVE List
- github.com/diegonehab/rply/blob/75639e3f12755ca64559d45a4a0bcffc52e04ef8/rply.c#L821-L848Referencevia CVE List