Denial of Service in Wings3D via Wavefront OBJ File

Executive Summary

CVE-2026-39020 is a denial-of-service vulnerability in Wings3D v2.4.1 caused by improper handling of IEEE 754 special float values like NaN, Inf, and -Inf in Wavefront OBJ files. The application crashes immediately when parsing crafted files due to an unhandled exception in its custom float parser.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes in Wings3D when importing Wavefront OBJ files. Check application logs for unhandled function_clause exceptions related to str2float_2/2 in e3d_obj.erl. Test suspicious OBJ files containing IEEE 754 special float values (NaN, Inf, -Inf) to observe crashes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows a local attacker to crash Wings3D by tricking a user into opening a malicious OBJ file. The crash may result in loss of unsaved work, but does not allow code execution or privilege escalation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it only causes a denial of service by crashing the application. It does not involve data exposure, unauthorized access, or loss of sensitive information that these regulations typically address.

Useful 0 Not Useful 0

Mitigation Strategies

Avoid opening untrusted Wavefront OBJ files in Wings3D. Update to a patched version if available. Implement file validation to block OBJ files containing IEEE 754 special float values. Consider using alternative software for OBJ file processing until the issue is resolved.

Useful 0 Not Useful 0