Carl Hurd of Cisco Talos discovered this vulnerability.

Cisco Talos recently discovered an exploitable heap-based buffer overflow vulnerability in the Chitubox AnyCubic plugin.

Chitubox is 3-D printing software for users to download and process models and send them to a 3-D printer. The specific AnyCubic plugin allows the software to convert the output of the Chitubox slicer (general format files) into the format expected by AnyCubic's series of printers. These converted files are then used directly for all functionality provided by the printers.

TALOS-2021-1376 (CVE-2021-21948) is a heap-based buffer overflow vulnerability that triggers if the user opens a specially crafted .gf file.

Cisco Talos is disclosing these issues despite no official fix available, all in accordance with Cisco's vulnerability disclosure policy.

Users are encouraged to update these affected products as soon as possible: AnyCubic Chitubox AnyCubic Plugin, version 1.0.0 and Chitubox Basic, version 1.8.1. Talos tested and confirmed this software is affected by this vulnerability.

The following SNORTⓇ rules will detect exploitation attempts against this vulnerability: 58233 and 58234. Additional rules may be released in the future and current rules are subject to change, pending additional vulnerability information. For the most current rule information, please refer to your Firepower Management Center or Snort.org.