| 标题 | assimp Open Asset Import Library (assimp) 6.0.2 Heap-based Buffer Overflow (CWE-122) |
|---|
| 描述 | MD5Importer::MakeDataUnique() in code/AssetLib/MD5/MD5Loader.cpp captures iNewIndex at the original vertex count before resizing mVertices to faces*3. When a crafted .md5mesh declares more vertices than triangle corners, iNewIndex exceeds the resized allocation and the first duplicate vertex write lands past the end of the heap buffer. The write is 16 bytes (sizeof VertexDesc) and repeats with each duplicate vertex encountered, giving an attacker-positioned write-past-end primitive. Impact: reliable heap corruption leading to crash (DoS).
Affected file: code/AssetLib/MD5/MD5Loader.cpp, function MD5Importer::MakeDataUnique(), parameter iNewIndex.
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H (7.0 High)
Discovered via AddressSanitizer and libFuzzer. Privately disclosed to the assimp project via GitHub Security Advisory (GHSA-vpmf-5xfw-mjp2) on 2026-06-24. Vendor contacted by email on 2026-07-11. No response received as of this submission date.
A pull request fixing this issue was independently submitted by a third party on 2026-06-28 and is currently open: https://github.com/assimp/assimp/pull/6718. This PR makes the vulnerability details effectively public.
The link to the private security advisory that was filed with the assimp project on 2026-06-24 is: https://github.com/assimp/assimp/security/advisories/GHSA-vpmf-5xfw-mjp2 (currently private; will become publicly accessible when published).
Project website: https://github.com/assimp/assimp
|
|---|
| 来源 | ⚠️ https://github.com/assimp/assimp/pull/6718 |
|---|
| 用户 | Errorgone (UID 99830) |
|---|
| 提交 | 2026-07-16 01時15分 (2 月前) |
|---|
| 管理 | 2026-08-30 08時12分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 397086 [Open Asset Import Library Assimp 直到 6.0.2 MD5Loader.cpp MakeDataUnique iNewIndex 内存损坏] |
|---|
| 积分 | 20 |
|---|