CVE-2026-2653 admesh normals.c stl_check_normal_vector heap-based overflow
A heap-based buffer overflow in admesh allows local attackers to execute arbitrary code or cause denial of service via crafted STL files.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-2653?
CVE-2026-2653 is a medium-severity memory corruption vulnerability in admesh, published on 18 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A security flaw has been discovered in admesh up to 0.98.5. This issue affects the function stl_check_normal_vector of the file src/normals.c. Performing a manipulation results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. It looks like this product is not really maintained anymore.
Which versions are affected by CVE-2026-2653?
1 open source package ship an affected version, including admesh. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
admesh PyPI | All versions | 0.98.6 |
Products include Admesh Project Admesh.
How do I fix CVE-2026-2653?
Upgrade admesh to 0.98.6 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-2653 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-2653 exists.
Other vulnerabilities in admesh
Sources
Also known as DEBIAN-CVE-2026-2653, GHSA-vcj6-96x2-26j3, PYSEC-2026-5, UBUNTU-CVE-2026-2653.