Out-of-bounds write in Talos Walt Disney Animation Studios PTEX
Priority MEDIUM 43CWE-787Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.
Summary
An exploitable out of bounds write vulnerability exists in version 2.2 of the Per Face Texture mapping application known as PTEX. The vulnerability is present in the reading of a file without proper parameter checking. The value read in, is not verified to be valid and its use can lead to a buffer overflow, potentially resulting in code execution.
Why it matters now
EPSS 0.02412 84th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Talos | Walt Disney Animation Studios PTEX | 2.2 | — | No fix listed | CNA |
- Walt Disney Animation Studios PTEX VendorTalos Affected 2.2 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:disneyanimation:ptex:2.2:*:*:*:*:*:*:* | 2.2 | Vulnerable | Disneyanimation |
- cpe:2.3:a:disneyanimation:ptex:2.2:*:*:*:*:*:*:* Versions 2.2 Vulnerable ·Disneyanimation
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2018-3835
- 2026-10-03 Alias added: GHSA-4rvj-v4gr-jxq6
References
Sources
- CVE-2018-3835 · CVE Program
- CVE-2018-3835 · NVD
- FIRST EPSS
- GHSA-4rvj-v4gr-jxq6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences