Executive brief
Assimp is a widely-used library for importing 3D model file formats used in games, CAD software, and graphics applications. A malformed LWO2 (LightWave 3D) model file can trigger a heap buffer overflow in the variable-sized index reader, allowing remote attackers to crash the application or potentially execute arbitrary code.
Technical details
The vulnerability is a heap-based buffer overflow in the ReadVSizedIntLWO2() helper function within the LWO2 model parser (code/AssetLib/LWO/LWOLoader.h). The function advances the file cursor by 2–4 bytes without validating that the cursor remains within the file buffer bounds. A malformed LWO2 file with a truncated polygon index section causes the parser to read out-of-bounds memory. The attack vector is network-based: any application using Assimp to parse untrusted model files is vulnerable without user interaction beyond loading the file. The patch (commit ee77bb0) adds bounds checking to guard every byte read against mFileBufferEnd and raises a DeadlyImportError on truncated input.
Affected products
- Assimp Assimp up to commit 09883e0 (before ee77bb09a42a49843ac85ef64c14d2328b251df1)
Timeline
- 2026-08-17: disclosed: Vulnerability published via NVD
- 2026-08-17: patched: Patch ee77bb09a42a49843ac85ef64c14d2328b251df1 available on GitHub