CVE-2026-115722

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-115722", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-23T11:26:42.342Z", "datePublished": "2026-10-23T11:36:46.355Z", "dateUpdated": "2026-10-29T13:00:26.916Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-23T11:36:46.355Z"}, "datePublic": "2026-10-21T12:48:18.000Z", "title": "RPly through 1.1.4 Out-of-Bounds Function Pointer Index via PLY Header", "descriptions": [{"lang": "en", "value": "RPly through 1.1.4 contains an improper array index validation vulnerability in ply_read_header_property() that accepts list as a list property's length or value type. Attackers can supply a crafted PLY file that makes ply_read_list_property() call an out-of-bounds handler, crashing ASCII parsing or corrupting memory in binary parsing."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Validation of Array Index", "cweId": "CWE-129", "type": "CWE"}]}], "affected": [{"vendor": "diegonehab", "product": "rply", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "1.1.4", "versionType": "semver", "status": "affected"}], "packageURL": "pkg:github/diegonehab/rply", "repo": "https://github.com/diegonehab/rply"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "HIGH", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/diegonehab/rply/issues/10", "tags": ["issue-tracking"]}, {"url": "https://github.com/diegonehab/rply/blob/75639e3f12755ca64559d45a4a0bcffc52e04ef8/rply.c#L1228-L1251", "tags": ["technical-description"]}, {"url": "https://github.com/diegonehab/rply/blob/75639e3f12755ca64559d45a4a0bcffc52e04ef8/rply.c#L821-L848", "tags": ["technical-description"]}, {"url": "https://hackmd.io/@haindpwn/rply-property-list-type-confusion", "tags": ["third-party-advisory"]}, {"name": "VulnCheck Advisory: RPly through 1.1.4 Out-of-Bounds Function Pointer Index via PLY Header", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/rply-through-1.1.4-out-of-bounds-function-pointer-index-via-ply-header"}], "credits": [{"lang": "en", "value": "HaiND from the Post and Telecommunication Institute of Technology", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"references": [{"url": "https://hackmd.io/@haindpwn/rply-property-list-type-confusion", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-29T12:59:18.511362Z", "id": "CVE-2026-115722", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T13:00:26.916Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-115722", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-29T12:59:18.511362Z"}}}], "references": [{"url": "https://hackmd.io/@haindpwn/rply-property-list-type-confusion", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T12:59:45.493Z"}}], "cna": {"title": "RPly through 1.1.4 Out-of-Bounds Function Pointer Index via PLY Header", "credits": [{"lang": "en", "type": "finder", "value": "HaiND from the Post and Telecommunication Institute of Technology"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"repo": "https://github.com/diegonehab/rply", "vendor": "diegonehab", "product": "rply", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1.4"}], "packageURL": "pkg:github/diegonehab/rply", "defaultStatus": "unaffected"}], "datePublic": "2026-10-21T12:48:18.000Z", "references": [{"url": "https://github.com/diegonehab/rply/issues/10", "tags": ["issue-tracking"]}, {"url": "https://github.com/diegonehab/rply/blob/75639e3f12755ca64559d45a4a0bcffc52e04ef8/rply.c#L1228-L1251", "tags": ["technical-description"]}, {"url": "https://github.com/diegonehab/rply/blob/75639e3f12755ca64559d45a4a0bcffc52e04ef8/rply.c#L821-L848", "tags": ["technical-description"]}, {"url": "https://hackmd.io/@haindpwn/rply-property-list-type-confusion", "tags": ["third-party-advisory"]}, {"url": "https://www.vulncheck.com/advisories/rply-through-1.1.4-out-of-bounds-function-pointer-index-via-ply-header", "name": "VulnCheck Advisory: RPly through 1.1.4 Out-of-Bounds Function Pointer Index via PLY Header", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "RPly through 1.1.4 contains an improper array index validation vulnerability in ply_read_header_property() that accepts list as a list property's length or value type. Attackers can supply a crafted PLY file that makes ply_read_list_property() call an out-of-bounds handler, crashing ASCII parsing or corrupting memory in binary parsing."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-129", "description": "Improper Validation of Array Index"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-23T11:36:46.355Z"}}}, "cveMetadata": {"cveId": "CVE-2026-115722", "state": "PUBLISHED", "dateUpdated": "2026-10-29T13:00:26.916Z", "dateReserved": "2026-10-23T11:26:42.342Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-23T11:36:46.355Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/diegonehab/rply", "product": "rply", "repo": "https://github.com/diegonehab/rply", "vendor": "diegonehab", "versions": [{"lessThanOrEqual": "1.1.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "RPly through 1.1.4 contains an improper array index validation vulnerability in ply_read_header_property() that accepts list as a list property's length or value type. Attackers can supply a crafted PLY file that makes ply_read_list_property() call an out-of-bounds handler, crashing ASCII parsing or corrupting memory in binary parsing."}], "id": "CVE-2026-115722", "lastModified": "2026-10-29T13:17:07.327", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 4.2, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-115722", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-29T12:59:18.511362Z", "version": "2.0.3"}}]}, "published": "2026-10-23T12:18:12.720", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/diegonehab/rply/blob/75639e3f12755ca64559d45a4a0bcffc52e04ef8/rply.c#L1228-L1251"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/diegonehab/rply/blob/75639e3f12755ca64559d45a4a0bcffc52e04ef8/rply.c#L821-L848"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/diegonehab/rply/issues/10"}, {"source": "disclosure@vulncheck.com", "url": "https://hackmd.io/@haindpwn/rply-property-list-type-confusion"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/rply-through-1.1.4-out-of-bounds-function-pointer-index-via-ply-header"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://hackmd.io/@haindpwn/rply-property-list-type-confusion"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-129"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "rply: rply: Denial of service via crafted PLY file", "id": "2559556", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559556"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["RPly through 1.1.4 contains an improper array index validation vulnerability in ply_read_header_property() that accepts list as a list property's length or value type. Attackers can supply a crafted PLY file that makes ply_read_list_property() call an out-of-bounds handler, crashing ASCII parsing or corrupting memory in binary parsing.", "A flaw was found in RPly. The parser improperly validates property definitions in file headers, allowing invalid list types to trigger out-of-bounds function calls. An attacker could exploit this vulnerability by tricking a user into opening a specially crafted Polygon File Format (PLY) file. Successful exploitation could lead to memory corruption or cause an application crash, resulting in a Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "Avoid opening or parsing untrusted PLY files with RPly-based applications until a fixed upstream release is available. Apply the upstream suggested patch (which adds PLY_LIST type validation in ply_read_header_property) once it is released."}, "name": "CVE-2026-115722", "public_date": "2026-10-23T11:36:46Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-115722\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-115722\nhttps://github.com/diegonehab/rply/blob/75639e3f12755ca64559d45a4a0bcffc52e04ef8/rply.c#L1228-L1251\nhttps://github.com/diegonehab/rply/blob/75639e3f12755ca64559d45a4a0bcffc52e04ef8/rply.c#L821-L848\nhttps://github.com/diegonehab/rply/issues/10\nhttps://hackmd.io/@haindpwn/rply-property-list-type-confusion\nhttps://www.vulncheck.com/advisories/rply-through-1.1.4-out-of-bounds-function-pointer-index-via-ply-header"], "statement": "A flaw was found in RPly through 1.1.4. The parser improperly validates list property definitions in PLY file headers: ply_read_header_property() accepts \"list\" as a list property's length or value type, so a crafted PLY file can make ply_read_list_property() call an out-of-bounds handler, crashing ASCII parsing or corrupting memory in binary parsing. Exploitation requires a user or application to parse an attacker-supplied crafted PLY file (user interaction required). No upstream fix is currently available; the suggested upstream patch adds PLY_LIST type validation in ply_read_header_property(), mirroring the checks already performed in ply_add_list_property().", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.1.4]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "rply", "source": "cna", "vendor": "diegonehab"}, "product": "rply", "vendor": "diegonehab"}], "created": "2026-10-23T13:30:07.787337+00:00", "updated": "2026-10-29T21:15:15.290622+00:00", "vendors": ["diegonehab", "diegonehab$PRODUCT$rply"]}