CVE-2025-8854
📋 TL;DR
A stack-based buffer overflow vulnerability in bulletphysics bullet3's LoadOFF function allows remote attackers to execute arbitrary code by providing a specially crafted OFF file with an overlong initial token. This affects all platforms using bullet3 versions before 3.26, particularly through the VHACD test utility or PyBullet's vhacd function.
💻 Affected Systems
- bulletphysics bullet3
- PyBullet (when using vhacd function)
- Applications using bullet3's VHACD functionality
📦 What is this software?
Pybullet by Bulletphysics
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the process running bullet3, potentially leading to full system compromise.
Likely Case
Application crash (denial of service) or limited code execution depending on exploit sophistication and environment.
If Mitigated
Denial of service if exploit fails or is blocked, with no code execution due to mitigations like ASLR or DEP.
🎯 Exploit Status
Exploitation requires crafting a malicious OFF file and getting it processed by the vulnerable function. No public exploit code is known at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.26
Vendor Advisory: https://github.com/bulletphysics/bullet3/issues/4732
Restart Required: Yes
Instructions:
1. Update bullet3 to version 3.26 or later. 2. Rebuild any applications using bullet3. 3. Restart services or applications using the updated library.
🔧 Temporary Workarounds
Disable VHACD processing of untrusted OFF files
allPrevent processing of untrusted OFF files through the VHACD functionality.
Input validation for OFF files
allImplement strict validation of OFF file tokens before passing to bullet3.
🧯 If You Can't Patch
- Restrict access to applications using bullet3's VHACD functionality to trusted users only.
- Implement network segmentation to isolate systems using vulnerable bullet3 versions.
🔍 How to Verify
Check if Vulnerable:
Check bullet3 version: if using version < 3.26 and processing OFF files via VHACD, system is vulnerable.Check Version:
Check bullet3 source or build configuration for version number; for PyBullet, check pip list or import bullet and check version.Verify Fix Applied:
Verify bullet3 version is 3.26 or later and rebuild applications with the updated library.📡 Detection & Monitoring
Log Indicators:
- Application crashes when processing OFF files
- Unexpected process termination in bullet3-related applications
Network Indicators:
- Unusual network traffic from systems running bullet3 applications
SIEM Query:
Process termination events for bullet3 or related applications, especially when OFF files are involved.