CVE-2026-2653: 
Python vulnerability analysis and mitigation

CVE-2026-2653 is a heap-based buffer overflow vulnerability in admesh up to version 0.98.5, specifically in the stl_check_normal_vector function within src/normals.c. The flaw was discovered by researcher LioTree via AFL++ fuzzing and reported on January 27, 2026, with public disclosure on February 18, 2026. It affects all versions of admesh through 0.98.5, a CLI and C library for processing triangulated solid meshes (STL files) that is no longer actively maintained. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper restriction of memory buffer operations (CWE-119, CWE-122 heap-based buffer overflow, CWE-126 buffer over-read) in the stl_check_normal_vector function in src/normals.c. The vulnerability is triggered when admesh processes a specially crafted STL file: the stl_check_normal_vector function calls stl_calculate_normal (at normals.c:276), which performs an out-of-bounds READ of 4 bytes on heap memory allocated by stl_allocate in stlinit.c:184. The call chain is main → stl_repair → stl_fix_normal_directions → stl_check_normal_vector → stl_calculate_normal, meaning any local user who can supply a malicious STL file to the admesh binary can trigger the overflow. The vulnerability was discovered through AFL++ fuzzing and a crash-reproducing test case (PoC file) has been publicly released (GitHub Issue #65, Red Hat Bugzilla).

Successful exploitation can result in memory corruption leading to high impacts on confidentiality, integrity, and availability of the affected system, as reflected in the CVSS v3.1 score. An attacker with local low-privileged access who can supply a crafted STL file to admesh could potentially read sensitive heap memory contents, corrupt data structures, or cause a process crash (denial of service). While the vulnerability is local in scope and does not directly enable remote code execution, memory corruption primitives can sometimes be chained for privilege escalation in environments where admesh is used in automated pipelines or with elevated privileges (Red Hat Advisory, GitHub Issue #65).

A proof-of-concept exploit file (a crafted STL input generated via AFL++ fuzzing) has been publicly released and is available for download (PoC File). There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.013% (0.000130), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The CVSS v4.0 exploit maturity is rated as PROOF_OF_CONCEPT (Feedly).

1. Reconnaissance: Identify systems running admesh version 0.98.5 or earlier, particularly in 3D printing, CAD, or automated mesh-processing pipelines where STL files are processed locally.
2. Craft malicious STL file: Create or obtain a specially crafted binary STL file that triggers the out-of-bounds read in stl_calculate_normal at normals.c:276. The publicly released AFL++ crash input (id:000035,sig:06,src:000550,time:910126,execs:241742,op:havoc,rep:5) can be used directly as a PoC.
3. Deliver the file: As a local low-privileged user, place the crafted STL file in a location accessible to the admesh process (e.g., a shared directory, upload folder in a web-facing 3D printing service, or directly via CLI).
4. Trigger processing: Execute admesh against the malicious file: admesh <malicious_file.stl>. The normal direction checking phase (stl_fix_normal_directions) will invoke the vulnerable code path.
5. Achieve impact: The heap-buffer-overflow is triggered in stl_calculate_normal, resulting in a process crash (denial of service) or potential memory disclosure/corruption depending on heap layout and exploitation technique (GitHub Issue #65, PoC File).

• Process: Unexpected crashes or aborts of the admesh process, particularly during the "Checking normal directions..." phase; AddressSanitizer output referencing stl_calculate_normal in src/normals.c:276 if built with ASan.
• Logs: System logs (e.g., /var/log/syslog, application logs) showing segmentation faults or abort signals from the admesh binary; core dump files generated in the working directory of admesh.
• File System: Presence of unusual or malformed STL files (e.g., binary STL files with anomalous facet counts or corrupted normal vector data) in directories processed by admesh; unexpected core dump files (core, core.<pid>) in admesh working directories.
• Network (if admesh is used in a web-facing pipeline): Unusual file uploads of STL files to processing endpoints, particularly files with very small sizes or corrupted headers (GitHub Issue #65).

No upstream patch has been released for admesh 0.98.5, as the project is effectively unmaintained. Organizations should evaluate whether admesh is still required and, if so, implement the following mitigations: (1) Restrict local access to the admesh binary using filesystem permissions and limit which users can execute it; (2) Avoid processing untrusted or externally supplied STL files with admesh; (3) Monitor Red Hat's advisory and Bugzilla entry for downstream patched packages if admesh is used as part of a Red Hat-based distribution; (4) Consider replacing admesh with an actively maintained alternative for STL processing. Red Hat has tracked this issue under Bugzilla bug 2440576 and may provide patched packages for affected distributions (Red Hat Bugzilla, Red Hat Advisory).

Red Hat has acknowledged the vulnerability and opened a security response bug (Bugzilla #2440576), classifying it as medium severity. The original reporter (LioTree) disclosed the issue via a GitHub issue on the admesh repository, noting it was discovered through AFL++ fuzzing. Community commentary has highlighted the concern that admesh is no longer actively maintained, making a timely upstream fix unlikely. No significant media coverage or broader security community discussion beyond vulnerability database entries has been observed (GitHub Issue #65, Red Hat Bugzilla).