---
id: CVE-2026-115722
title: RPly through 1.1.4 Out-of-Bounds Function Pointer Index via PLY Header
summary: >-
  RPly through 1.1.4 contains an improper array index validation vulnerability
  in ply_read_header_property() that accepts list as a list property's length or
  value type. Attackers can supply a crafted PLY file that makes
  ply_read_list_prop…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H'
cvssSource: cna
cwe:
  - CWE-129
vendor: diegonehab
product: rply
affected:
  - rply <= 1.1.4
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T11:36:46.355Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115722'
references:
  - url: 'https://github.com/diegonehab/rply/issues/10'
  - url: >-
      https://github.com/diegonehab/rply/blob/75639e3f12755ca64559d45a4a0bcffc52e04ef8/rply.c#L1228-L1251
  - url: >-
      https://github.com/diegonehab/rply/blob/75639e3f12755ca64559d45a4a0bcffc52e04ef8/rply.c#L821-L848
  - url: 'https://hackmd.io/@haindpwn/rply-property-list-type-confusion'
  - url: >-
      https://www.vulncheck.com/advisories/rply-through-1.1.4-out-of-bounds-function-pointer-index-via-ply-header
    label: >-
      VulnCheck Advisory: RPly through 1.1.4 Out-of-Bounds Function Pointer
      Index via PLY Header
tags:
  - cve.org
ingestedAt: '2026-10-23T13:24:55.587Z'
---

## Overview

RPly through 1.1.4 contains an improper array index validation vulnerability in ply_read_header_property() that accepts list as a list property's length or value type. Attackers can supply a crafted PLY file that makes ply_read_list_property() call an out-of-bounds handler, crashing ASCII parsing or corrupting memory in binary parsing.

## Affected

- `rply <= 1.1.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.