| Titolo | assimp Open Asset Import Library (assimp) 6.0.2 Heap-based Buffer Overflow (CWE-122) |
|---|
| Descrizione | MD5Importer::MakeDataUnique() in code/AssetLib/MD5/MD5Loader.cpp captures iNewIndex at the original vertex count before resizing mVertices to faces*3. When a crafted .md5mesh declares more vertices than triangle corners, iNewIndex exceeds the resized allocation and the first duplicate vertex write lands past the end of the heap buffer. The write is 16 bytes (sizeof VertexDesc) and repeats with each duplicate vertex encountered, giving an attacker-positioned write-past-end primitive. Impact: reliable heap corruption leading to crash (DoS).
Affected file: code/AssetLib/MD5/MD5Loader.cpp, function MD5Importer::MakeDataUnique(), parameter iNewIndex.
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H (7.0 High)
Discovered via AddressSanitizer and libFuzzer. Privately disclosed to the assimp project via GitHub Security Advisory (GHSA-vpmf-5xfw-mjp2) on 2026-06-24. Vendor contacted by email on 2026-07-11. No response received as of this submission date.
A pull request fixing this issue was independently submitted by a third party on 2026-06-28 and is currently open: https://github.com/assimp/assimp/pull/6718. This PR makes the vulnerability details effectively public.
The link to the private security advisory that was filed with the assimp project on 2026-06-24 is: https://github.com/assimp/assimp/security/advisories/GHSA-vpmf-5xfw-mjp2 (currently private; will become publicly accessible when published).
Project website: https://github.com/assimp/assimp
|
|---|
| Fonte | ⚠️ https://github.com/assimp/assimp/pull/6718 |
|---|
| Utente | Errorgone (UID 99830) |
|---|
| Sottomissione | 16/07/2026 01:15 (2 mesi fa) |
|---|
| Moderazione | 30/08/2026 08:12 (2 months later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 397086 [Open Asset Import Library Assimp fino a 6.0.2 MD5Loader.cpp MakeDataUnique iNewIndex buffer overflow] |
|---|
| Punti | 20 |
|---|