| 제목 | assimp Open Asset Import Library (assimp) 6.0.2 Heap-based Buffer Overflow (CWE-122) |
|---|
| 설명 | MD5Importer::MakeDataUnique() in code/AssetLib/MD5/MD5Loader.cpp captures iNewIndex at the original vertex count before resizing mVertices to faces*3. When a crafted .md5mesh declares more vertices than triangle corners, iNewIndex exceeds the resized allocation and the first duplicate vertex write lands past the end of the heap buffer. The write is 16 bytes (sizeof VertexDesc) and repeats with each duplicate vertex encountered, giving an attacker-positioned write-past-end primitive. Impact: reliable heap corruption leading to crash (DoS).
Affected file: code/AssetLib/MD5/MD5Loader.cpp, function MD5Importer::MakeDataUnique(), parameter iNewIndex.
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H (7.0 High)
Discovered via AddressSanitizer and libFuzzer. Privately disclosed to the assimp project via GitHub Security Advisory (GHSA-vpmf-5xfw-mjp2) on 2026-06-24. Vendor contacted by email on 2026-07-11. No response received as of this submission date.
A pull request fixing this issue was independently submitted by a third party on 2026-06-28 and is currently open: https://github.com/assimp/assimp/pull/6718. This PR makes the vulnerability details effectively public.
The link to the private security advisory that was filed with the assimp project on 2026-06-24 is: https://github.com/assimp/assimp/security/advisories/GHSA-vpmf-5xfw-mjp2 (currently private; will become publicly accessible when published).
Project website: https://github.com/assimp/assimp
|
|---|
| 원천 | ⚠️ https://github.com/assimp/assimp/pull/6718 |
|---|
| 사용자 | Errorgone (UID 99830) |
|---|
| 제출 | 2026. 07. 16. AM 01:15 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 30. AM 08:12 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 397086 [Open Asset Import Library Assimp 까지 6.0.2 MD5Loader.cpp MakeDataUnique iNewIndex 메모리 손상] |
|---|
| 포인트들 | 20 |
|---|