CVE-2025-8854 is a critical stack based buffer overflow in the OFF file loader of bulletphysics bullet3 before version 3.26. It is reachable through the VHACD test utility or through PyBullet's vhacd function when given a crafted OFF file. The record says upgrade past 3.26, but the upstream issue still looked open when read.
What's affected
- Product: bulletphysics bullet3 before 3.26, on all platforms, and PyBullet where its
vhacdfunction is used. - Component:
LoadOFFinExtras/VHACD/test/src/main_vhacd.cpp, triggered by an OFF file with an overlong first token. - Weaknesses: CWE-120 (classic buffer overflow) and CWE-787 (out-of-bounds write).
- Score: CVSS 3.1 base 9.8, Critical, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. - Fixed version: the record says before 3.26, which implies 3.26 or later. I could not confirm that from the project's own pages.
The sources do not fully agree on the fix. The record limits the affected range to versions before 3.26. The upstream GitHub issue, filed on 11 August 2025 under the CVE number, shows no assigned maintainer, no linked pull request and an open state when I read it. It suggests a bounded read as the fix. So whether 3.26 contains a fix is not established by what I could read, and the advisory should be checked before you rely on a version number.
The severity also deserves context. The Critical score assumes the vulnerable code runs on untrusted input. The report ties it to a utility that is usually run by hand on a developer's own files. Your real exposure depends on whether untrusted OFF files ever reach it.
The record does not flag this CVE as exploited, and it is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
Start by finding where Bullet or PyBullet is installed.
pip show pybullet
pip list | grep -i bullet
Then search your code for calls to the vulnerable path.
grep -rn "vhacd" --include="*.py" .
If nothing calls vhacd, and you do not run the VHACD test utility from a Bullet3 build, the vulnerable code path is not in use for you, even if the package is present. If you do call it, find where the input file comes from. A file you generated yourself is a different risk from a file uploaded by a user or downloaded from a model sharing site.
For C++ projects, check whether you build the Extras folder or ship the VHACD test binary.
What to do now
- List every project that depends on Bullet3 or PyBullet, including simulation, robotics and machine learning pipelines.
- Do not pass untrusted OFF files to
vhacdor the VHACD utility. - Upgrade to a Bullet3 or PyBullet release that the project confirms fixes it, once available. Until then treat the issue as not fixed.
- If you must process files from outside, convert or validate them first, and cap the length of the first token or the file's header before parsing.
- Run any conversion job in a container or sandbox with no network and no secrets.
- Rebuild any binary that includes the affected test utility with stack protections turned on.
Why it matters
The cause is an unbounded read into a fixed size buffer on the stack. When a file's first token is longer than the buffer, the extra bytes overwrite memory next to it. At best the program crashes. At worst, depending on compiler protections, an attacker may control what runs. That is why the score is 9.8 on paper.
Reachability decides how much it matters in practice. A library can contain a dangerous function that your code never calls. Knowing the difference saves a great deal of triage effort, and it is the question a reachability analysis answers.
You can run the free in-browser dependency scan at gold.safeguard.sh/scan on your manifests to see which known-vulnerable packages you carry. It reads dependencies, so it will not see a flaw that lives only in an application's own source.
Try it yourself
Click through it at your own pace, or open it full screen.
This demo shows how reachability analysis separates a vulnerable function you actually call from one that is merely present.
Quick check
Am I affected if I only use PyBullet for simulation?
Only if your code calls vhacd or runs the VHACD utility on untrusted OFF files. Having the package installed is not enough on its own.
Does version 3.26 fix it?
The record implies so by listing versions before 3.26 as affected. The upstream issue showed no linked fix when I read it, so confirm with the project.
Sources
- Safeguard Gold entry: CVE-2025-8854 (NVD record data: description, CVSS, CWEs, published 2025-08-11)
- Upstream issue listed in the record: bullet3 issue 4732
- Source file listed in the record: main_vhacd.cpp
Last reviewed: 18 October 2026.
