CVE-2020-28596: 
Homebrew vulnerability analysis and mitigation

A stack-based buffer overflow vulnerability (CVE-2020-28596) was discovered in the Objparser::objparse() functionality of Prusa Research PrusaSlicer 2.2.0 and Master (commit 4b040b856). The vulnerability was discovered on December 14, 2020, patched on January 14, 2021, and publicly disclosed on April 21, 2021. The vulnerability affects PrusaSlicer, an open-source 3-D printer slicing program that converts various 3-D model file formats to printer-readable Gcode (Talos Report).

The vulnerability exists in the OBJ file parsing functionality, specifically in PrusaSlicer/src/libslic3r/Format/OBJ.cpp and PrusaSlicer/src/libslic3r/Format/objparser.cpp. The issue occurs when fread is called to read into a fixed-size stack buffer inside a while loop that is controlled by the input file's content. The CVSS v3.0 score is 8.8 (HIGH) with vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-121 (Stack-based Buffer Overflow) (Talos Report).

A successful exploitation of this vulnerability can lead to arbitrary code execution on the affected system. The vulnerability allows an attacker to overflow a stack buffer, potentially taking control of the program execution flow (Talos Report).

The vulnerability can be triggered by providing a specially crafted OBJ file to the application. An attacker needs to convince a user to process a malicious file to exploit this vulnerability. The attack requires user interaction but no special privileges (Talos Report).

The vulnerability was patched by the vendor on January 14, 2021. Users should upgrade to a version of PrusaSlicer released after this date to protect against this vulnerability (Talos Report).