Executive brief
Assimp is a widely used library for importing and processing 3D model files in various formats. A security flaw in its model handling component could allow a local attacker to cause a system crash or potentially execute unauthorized code by providing a specially crafted 3D model file. This could lead to service disruptions or unauthorized access to data on the affected system.
Technical details
A heap-based buffer overflow vulnerability exists in the Assimp::SceneCombiner::Copy function within code/Common/SceneCombiner.cpp of the Open Asset Import Library (Assimp). The flaw is triggered by improper manipulation of width and height arguments during model file processing. An attacker with local access can exploit this by providing a malicious model file, leading to memory corruption. This can result in a denial-of-service (crash) or potentially arbitrary code execution. The vulnerability affects versions up to 5.4.3 and has been publicly disclosed.
Affected products
- Open Asset Import Library Assimp up to 5.4.3
Timeline
- 2026-07-01: advisory: NVD publication date
- 2026-07-01: disclosed: Public disclosure of the exploit