| Título | assimp >= v4.0.0 Out-of-Bounds Read |
|---|
| Descripción | Open Asset Import Library (assimp) is a portable library for importing various 3D model formats.
This code is vulnerable to CWE‑125: Out‑of‑bounds Read due to improper handling of the internal cache buffer in IOStreamBuffer. The getNextBlock() function returns data from the physical end (m_cache.end()) instead of the logical end (m_cache.begin() + m_cacheSize). When the PLY loader opens a file smaller than its 1 MiB pre‑filled cache, this returns stale filler bytes beyond the actual content. An attacker can supply a binary PLY file whose header declares more faces than the body provides; the parser interprets filler bytes as valid indices (e.g., 0x0A as count 10, 0x0A0A0A0A as vertex index 168430090) and stores them without bounds checks. With aiProcess_Triangulate, this leads to a segmentation fault; without it, the library returns a corrupted scene, potentially crashing downstream consumers. Sanitizers detect the issue; release builds may experience memory corruption and denial of service.
More details: reported to assimp maintainers on 2026‑08‑16 (pending public disclosure). For additional information, including the exact affected version range, it can be provided via email. |
|---|
| Usuario | cz_seuer (UID 100791) |
|---|
| Sumisión | 2026-09-01 11:15 (hace 1 mes) |
|---|
| Moderación | 2026-10-10 17:28 (1 month later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 416230 [Open Asset Import Library Assimp hasta 6.0.5 PLY File getNextBlock divulgación de información] |
|---|
| Puntos | 17 |
|---|