Threat Intelligence Database

A heap-based buffer overflow vulnerability exists in the Open Asset Import Library (Assimp) versions 5.4.0 through 5.4.3. The issue occurs in the function Assimp::SceneCombiner::Copy within the Model File Handler component, triggered by manipulation of width and height arguments. Exploitation requires local access. The vulnerability has been publicly disclosed and is tracked under issue #6128. The CVSS 4.8 score indicates medium severity.

A security vulnerability has been detected in Assimp up to 6.0.4. Affected by this issue is the function HL1MDLLoader::read_sequence_infos of the file HL1MDLLoader.cpp of the component Half-Life 1 MDL Loader. The manipulation of the argument aiString leads to out-of-bounds read. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The project tagged the reported issue as bug.

A weakness has been identified in Assimp up to 6.0.4. Affected by this vulnerability is the function aiNode::~aiNode of the file scene.cpp of the component ASE File Parser. Executing a manipulation can lead to use after free. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. The project tagged the reported issue as bug.