CVE-2022-38072: ADMesh Heap Buffer Overflow Vulnerability in STL File Processing
Summary
CVE-2022-38072: An improper array index validation vulnerability exists in the stl_fix_normal_directions functionality of ADMesh Master Commit 767a105 and v0.98.4. Affects admesh versions < 5fab257268a0ee6f832c18d72af89810a29fbd5f. Fixed in 5fab257268a0ee6f832c18d72af89810a29fbd5f. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ADMesh is an open-source software package designed for processing and repairing STL files, commonly used in 3D printing and computer-aided design. It provides functionalities to manipulate and analyze 3D models, making it a valuable tool for developers and designers. However, a vulnerability has been identified in the way ADMesh handles STL files, specifically in the stl_fix_normal_directions function, which can lead to severe security risks.
Vulnerability Detail
An improper array index validation vulnerability exists in the stl_fix_normal_directions functionality of ADMesh, specifically in versions prior to the fix introduced in commit 5fab257268a0ee6f832c18d72af89810a29fbd5f. This vulnerability can be exploited by an attacker using a specially-crafted STL file, leading to a heap buffer overflow. The ramifications of this vulnerability include potential arbitrary code execution, data corruption, and system crashes, making it critical for users to address this issue promptly.
How To Fix
Latest published version: 0.98.9 as of 23 Oct 2026
pip install --upgrade "admesh==0.98.9"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5fab257268a0ee6f832c18d72af89810a29fbd5f
This is the first release that contains the fix.
pip install --upgrade "admesh==5fab257268a0ee6f832c18d72af89810a29fbd5f"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid processing untrusted or unknown STL files until the package is updated. Additionally, implementing file validation checks before processing can help mitigate the risk of exploitation.
Conclusion
The CVE-2022-38072 vulnerability in ADMesh poses a significant risk due to improper handling of STL files, leading to potential heap buffer overflows. Users are strongly advised to update to the latest version of the package to mitigate this risk. Additionally, monitoring tools like Vulert can help keep your projects secure from similar vulnerabilities.
See every vulnerability recorded for admesh →
FAQ
CVE-2022-38072 is a vulnerability in the ADMesh package that allows for a heap buffer overflow through improper array index validation when processing STL files.
If you are using ADMesh version 0.98.4 or earlier, your version is affected by this vulnerability. Check your version using 'pip show admesh'.
Exploitation of this vulnerability can lead to arbitrary code execution, data corruption, and crashes, posing significant risks to system integrity and security.
Yes, tools like Vulert can monitor your project for open-source vulnerabilities in real-time using your Pipfile.lock. You can check your application's status without needing to install anything.
Detailed information about CVE-2022-38072 can be found in the advisory database and on the official GitHub repository of ADMesh.
References
Related vulnerabilities
Recent vulnerabilities recorded for admesh.
