Description
A security flaw has been discovered in admesh up to 0.98.5. This issue affects the function stl_check_normal_vector of the file src/normals.c. Performing a manipulation results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. It looks like this product is not really maintained anymore.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | admesh | 0.98.0, 0.98.1, 0.98.2, 0.98.3, 0.98.4, 0.98.5 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | admesh | No fix yet | — |
| Debian 13 | admesh | No fix yet | — |
| Debian 12 | admesh | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | admesh | No fix yet | — |
| Ubuntu 26.04 LTS | admesh | No fix yet | — |
| Ubuntu 25.10 | admesh | No fix yet | — |
| Ubuntu 24.04 LTS | admesh | No fix yet | — |
| Ubuntu 22.04 LTS | admesh | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | admesh | No fix yet | — |
| Ubuntu 18.04 LTS | admesh | No fix yet | — |
| Ubuntu 16.04 LTS | admesh | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | admesh | < 0.98.6 | 0.98.6 | PYSEC-2026-5 |
References
- VDB-346450 | admesh normals.c stl_check_normal_vector heap-based overflow vdb-entry technical-description
- VDB-346450 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #752596 | Debian admesh <=0.98.5 Heap-based Buffer Overflow third-party-advisory
- https://github.com/admesh/admesh/issues/65 issue-tracking
- https://github.com/admesh/admesh/issues/65#issuecomment-3804571402 issue-tracking
- https://github.com/user-attachments/files/24878279/id.000035.sig.06.src.000550.time.910126.execs.241742.op.havoc.rep.5.zip exploit
- https://github.com/admesh/admesh/ product