| शीर्षक | Assimp commit 17c12da Double Free |
|---|
| विवरण | A critical double-free memory corruption vulnerability exists in Assimp Library's PLY model parsing and exporting module. The flaw stems from conflicting memory ownership management of aiScene and aiMesh objects during model loading and exporting operations. When loading a maliciously crafted PLY model file via Assimp::Importer::ReadFileFromMemory and directly passing the returned const aiScene* object to Assimp::Exporter::ExportToBlob, duplicate memory release operations are triggered. The ExportToBlob function takes ownership of the scene object through std::unique_ptr<aiScene> and frees the associated aiMesh memory during pointer destruction. Subsequently, the Assimp::Importer destructor attempts to free the already released mesh memory again, resulting in a valid double-free corruption. This vulnerability occurs due to unreasonable memory ownership rules between the importer and exporter modules, causing redundant release of heap memory allocated by the PLY format loader. Remote attackers can exploit this flaw by supplying a malformed PLY model file, triggering memory corruption and program crash to cause a denial-of-service (DoS) condition, and potentially enabling arbitrary code execution or sensitive memory information disclosure. |
|---|
| स्रोत | ⚠️ https://github.com/assimp/assimp/issues/6620 |
|---|
| उपयोगकर्ता | TYGLS (UID 94774) |
|---|
| सबमिशन | 01/06/2026 08:11 AM (4 महीनों पहले) |
|---|
| संयम | 03/07/2026 03:44 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 376112 [Open Asset Import Library Assimp तक 6.0.4 PLY Model PlyLoader.cpp ExportToBlob बफ़र ओवरफ़्लो] |
|---|
| अंक | 20 |
|---|