CVE-2025-8854 HIGH

CVE-2025-8854: bullet3 VHACD utility: stack-based buffer overflow in OFF parser (LoadOFF)

Vendor Bulletphysics
Product bullet3
Weakness CWE-120
Published August 11, 2025
Last update August 11, 2025
View on NVD All CVEs

CVSS base score

8.4/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Stack-based buffer overflow in LoadOFF in bulletphysics bullet3 before 3.26 on all platforms allows remote attackers to execute arbitrary code via a crafted OFF file with an overlong initial token processed by the VHACD test utility or invoked indirectly through PyBullet's vhacd function.

Key dates

02Disclosure timeline

August 11, 2025 CVE published
August 11, 2025 Record updated