Assimp vulnerabilities

A buffer overflow vulnerability was found in the Assimp library up to version 6.0.2 in the FBX Importer. The issue occurs in aiMaterial::AddBinaryProperty, where a property key string from a crafted FBX file is copied into a fixed-size heap buffer using strcpy() without runtime length validation.

A vulnerability has been detected in the Assimp library (Open Asset Import Library) version 17c12da. The issue affects the function Assimp::MDLImporter::ParseBoneTrafoKeys_3DGS_MDL7 in file code/AssetLib/MDL/MDLLoader.cpp, where manipulation of arguments transmatrix_count/pcBoneTransforms leads to buffer overflow. The attack can be initiated remotely, and the exploit is publicly available.

A vulnerability was detected in Open Asset Import Library Assimp 17c12da. This affects the function Assimp::MDLImporter::AddBonesToNodeGraph_3DGS_MDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component Node Parser. The manipulation of the argument bones_num results in heap-based buffer overflow. The attack can be executed remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

A security vulnerability has been detected in Open Asset Import Library Assimp 17c12da. The impacted element is the function Assimp::MDLImporter::GenerateOutputMeshes_3DGS_MDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component 3DGS MDL7 Model Output Mesh Generator. The manipulation leads to buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

A weakness has been identified in Open Asset Import Library Assimp 17c12da in the function Assimp::MDLImporter::ReadFaces_3DGS_MDL7 in the file code/AssetLib/LWO/LWOLoader.h of the 3DGS MDL7 Model Parser component. Manipulation can lead to a heap-based buffer overflow. The attack can be launched remotely, and the exploit is publicly available.

A security flaw has been discovered in Open Asset Import Library Assimp 17c12da in the function Assimp::Compression::decompressBlock of the file code/Common/Compression.cpp of the File Parser component. Manipulation results in a heap-based buffer overflow. The attack can be initiated remotely, and the exploit has been released publicly.

A vulnerability has been found in Open Asset Import Library Assimp up to version 6.0.5 in the function Assimp::CSMImporter::InternReadFile within CSMLoader.cpp. The flaw causes a heap-based buffer overflow when processing CSM files. The attack requires local access and an exploit has been published.

A vulnerability was found in Open Asset Import Library Assimp up to version 6.0.4 in the function Assimp::Exporter::ExportToBlob in file code/AssetLib/Ply/PlyLoader.cpp. Manipulation in PLY model handling leads to a double free. The attack can be initiated remotely, and the exploit has been publicly disclosed.

A heap-based buffer overflow vulnerability was found in Open Asset Import Library Assimp up to version 5.4.3 in the Assimp::SceneCombiner::Copy function. Manipulating width/height arguments triggers the overflow.

In Assimp up to 6.0.4, the HL1MDLLoader::read_sequence_infos function has an out-of-bounds read via the aiString argument. Local access required; exploit public.

In Assimp up to version 6.0.4, a vulnerability was found in the function aiNode::~aiNode in file scene.cpp of the ASE File Parser component. Manipulation can lead to use-after-free. The attack requires local access.

In Assimp up to version 6.0.4, a vulnerability was found in the function HL1MDLLoader::extract_anim_value in file HL1MDLLoader.cpp of the Half-Life 1 MDL Loader component. Manipulation of the num.total argument leads to a heap-based buffer overflow. The attack requires local access.

A heap-based buffer overflow in the function Assimp::MDL::HalfLife::HL1MDLLoader::read_animations in Assimp up to version 6.0.4 allows local attackers to cause a crash or potentially execute arbitrary code.

A heap-based buffer overflow in the function HL1MDLLoader::read_meshes in Assimp up to version 6.0.4 allows local attackers to cause a crash or potentially execute arbitrary code.

In Assimp up to 6.0.4, the FBXExporter::WriteObjects function has a divide-by-zero vulnerability. Local access required; exploit public.

In Assimp up to version 6.0.4, a vulnerability was found in the function glTFCommon::CopyValue in library glTFCommon.h of the 4x4 Matrix Parser component. Manipulation leads to a heap-based buffer overflow. The attack requires local access.

A vulnerability in Assimp up to version 6.0.4 affects the glTF2::LazyDict function in glTF2Asset.h, leading to a null pointer dereference via the operator[] argument. Local access is required, and the exploit is public.

In Assimp up to 6.0.4, the Assimp::glTFImporter::ImportMeshes function has a null pointer dereference. Local access required; exploit public.

A vulnerability in Assimp up to version 6.0.4 affects the glTF2Importer::ImportEmbeddedTextures function in glTF2Importer.cpp, causing a null pointer dereference. Local access is required, and the exploit is public.

A denial of service vulnerability was found in Assimp v.6.0.2 in the ParseVectorDataArray() function within FBXParser.cpp. A remote attacker can exploit this by sending specially crafted data, causing the application to crash.

A vulnerability in Assimp v.6.0.2 allows a remote attacker to cause a denial of service (DoS) by exploiting an issue in FBXConverter.cpp, specifically in the FBXConverter::ConvertMeshMultiMaterial() function.

A denial of service vulnerability has been discovered in Assimp version 6.0.2. The issue resides in FBXMeshGeometry.cpp within the MeshGeometry::MeshGeometry() function. A remote attacker can exploit this flaw to cause a denial of service.

An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXConverter.cpp and ConvertMeshMultiMaterial() method.