Submit #955038: assimp >= v4.0.0 Out-of-Bounds Read

Open Asset Import Library (assimp) is a portable library for importing various 3D model formats.
This code is vulnerable to CWE‑125: Out‑of‑bounds Read due to improper handling of the internal cache buffer in IOStreamBuffer. The getNextBlock() function returns data from the physical end (m_cache.end()) instead of the logical end (m_cache.begin() + m_cacheSize). When the PLY loader opens a file smaller than its 1 MiB pre‑filled cache, this returns stale filler bytes beyond the actual content. An attacker can supply a binary PLY file whose header declares more faces than the body provides; the parser interprets filler bytes as valid indices (e.g., 0x0A as count 10, 0x0A0A0A0A as vertex index 168430090) and stores them without bounds checks. With aiProcess_Triangulate, this leads to a segmentation fault; without it, the library returns a corrupted scene, potentially crashing downstream consumers. Sanitizers detect the issue; release builds may experience memory corruption and denial of service.
More details: reported to assimp maintainers on 2026‑08‑16 (pending public disclosure). For additional information, including the exact affected version range, it can be provided via email.

• User: cz_seuer (UID 100791)
• Submission: 09/01/2026 11:15 (1 month ago)
• Moderation: 10/10/2026 17:28 (1 month later)
• Status: Accepted
• VulDB entry: 416230 [Open Asset Import Library Assimp up to 6.0.5 PLY File getNextBlock out-of-bounds]
• Points: 17