CVE-2025-8854

CVE-2025-8854 is a critical stack-based buffer overflow vulnerability affecting bulletphysics bullet3 versions prior to 3.26, including PyBullet's vhacd function. An unauthenticated remote attacker can exploit this by providing a specially crafted OFF file with an overlong initial token, leading to arbitrary code execution. With a CVSS score of 9.8 (CRITICAL), this vulnerability poses a significant risk due to its network-based attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation or publicly available exploit code, the vulnerability has garnered notable community discussion, indicating awareness and potential future exploitation.