Vulnerability Spotlight: Use-after-free vulnerability in 3MF Consortium lib3mf

Summary: Cisco Talos discovered a use-after-free vulnerability in 3MF Consortium's lib3mf 2.0.0, specifically in the NMR::COpcPackageReader::releaseZIP() functionality, where a specially crafted 3MF file can lead to remote code execution. The open-source library implements the 3MF file format used mainly for 3D printing, and has been confirmed in use in open-source programs including OpenSCAD and LibCGAL; Talos worked with 3MF Consortium to resolve the issue and release an update.
Why it matters: The flaw is triggered by a file a target simply opens, and lib3mf is embedded in downstream products like OpenSCAD and LibCGAL, so the vulnerable code can sit inside software your teams already run without the library name appearing anywhere on the box.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2021-21772
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026