| 标题 | Assimp commit 17c12da Heap-based Buffer Overflow |
|---|
| 描述 | A heap-buffer-overflow vulnerability exists in Assimp's 3DGS MDL file parser within the Assimp::MDLImporter::ParseSkinLump_3DGS_MDL7() function at MDLMaterialLoader.cpp:772. The flaw is caused by insufficient pointer boundary validation when parsing malicious MDL model files. During the parsing of skin lump data, the program increments the read pointer continuously by fixed offset values without verifying whether the pointer exceeds the boundary of the allocated heap buffer before recursive function calls. A specially crafted MDL file can make the read pointer go beyond the valid buffer range, causing the program to illegally read 4 bytes of out-of-bounds heap memory. This memory corruption vulnerability can trigger program crash, and remote attackers can exploit this flaw via a malicious MDL file to launch denial-of-service (DoS) attacks. |
|---|
| 来源 | ⚠️ https://github.com/assimp/assimp/issues/6629 |
|---|
| 用户 | TYGLS (UID 94774) |
|---|
| 提交 | 2026-06-29 14時44分 (3 月前) |
|---|
| 管理 | 2026-08-16 09時50分 (2 months later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 310293 [Open Asset Import Library Assimp 5.4.3 MDLMaterialLoader.cpp ParseSkinLump_3DGS_MDL7 信息公开] |
|---|
| 积分 | 0 |
|---|