| 标题 | Assimp v5.4.3 Heap-based Buffer Overflow |
|---|
| 描述 | A heap-based buffer overflow vulnerability exists in Assimp Library within the Assimp::SceneCombiner::Copy function at SceneCombiner.cpp:1198. The flaw is caused by insufficient boundary validation on the original texture data buffer before executing memory copy operations. When processing a maliciously crafted model file, the function calculates the copy size based on texture width and height parameters without verifying that the actual allocated heap buffer of the original old texture data matches the calculated size. This leads the memcpy function to copy excessive data beyond the boundary of the valid heap memory region, triggering a 4-byte out-of-bounds heap read and resulting in program crash during scene combination and export processing. Remote attackers can exploit this vulnerability by supplying a specially crafted malicious model file. Successful exploitation can cause a denial-of-service (DoS) condition, with potential risks of sensitive memory information disclosure and arbitrary code execution under specific memory environments. |
|---|
| 来源 | ⚠️ https://github.com/assimp/assimp/issues/6079 |
|---|
| 用户 | TYGLS (UID 94774) |
|---|
| 提交 | 2026-06-01 05時35分 (2 月前) |
|---|
| 管理 | 2026-06-29 06時58分 (28 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 374595 [Open Asset Import Library Assimp 直到 5.4.3 Model File SceneCombiner.cpp Copy width/height 内存损坏] |
|---|
| 积分 | 20 |
|---|