Vulnerability · Published Oct 23, 2026 · Assigned by VulnCheck

CVE-2026-115722RPly through 1.1.4 Out-of-Bounds Function Pointer Index via PLY Header

Medium 6.1

In plain English

A medium-severity security flaw in rply from diegonehab. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.1%top 97.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

RPly through 1.1.4 contains an improper array index validation vulnerability in ply_read_header_property() that accepts list as a list property's length or value type. Attackers can supply a crafted PLY file that makes ply_read_list_property() call an out-of-bounds handler, crashing ASCII parsing or corrupting memory in binary parsing.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	python-rply	no fix listed	DEBIAN-CVE-2026-115722
Debian:13	python-rply	no fix listed	DEBIAN-CVE-2026-115722
Debian:14	python-rply	no fix listed	DEBIAN-CVE-2026-115722
Ubuntu:26.04:LTS	rply	no fix listed	UBUNTU-CVE-2026-115722
Ubuntu:26.10	rply	no fix listed	UBUNTU-CVE-2026-115722

Affected products (as reported)

Vendor	Product	Versions
diegonehab	rply	0 – through 1.1.4

Weakness: CWE-129 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

References

https://github.com/diegonehab/rply/issues/10 issue-tracking
https://github.com/diegonehab/rply/blob/75639e3f12755ca64559d45a4a0bcffc52e04ef8/rply.c#L1228-L1251 technical-description
https://github.com/diegonehab/rply/blob/75639e3f12755ca64559d45a4a0bcffc52e04ef8/rply.c#L821-L848 technical-description
https://hackmd.io/@haindpwn/rply-property-list-type-confusion third-party-advisory
VulnCheck Advisory: RPly through 1.1.4 Out-of-Bounds Function Pointer Index via PLY Header third-party-advisory