Description

A security flaw has been discovered in Open Asset Import Library Assimp 17c12da. Impacted is the function Assimp::Compression::decompressBlock of the file code/Common/Compression.cpp of the component File Parser. Performing a manipulation results in heap-based buffer overflow. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-17T01:16:44.370Z",
  "pubdate": "2026-08-17T01:16:44.370Z",
  "executiveSummary": "A critical security flaw has been identified in the Open Asset Import Library Assimp 17c12da, specifically within the file parsing component. The vulnerability is categorized as a heap-based buffer overflow, residing in the Assimp::Compression::decompressBlock function located in code/Common/Compression.cpp. Successful exploitation of this vulnerability can lead to memory corruption, potentially allowing arbitrary code execution, denial of service, or application crashes.\nThe affected system is the Open Asset Import Library Assimp version 17c12da, which is widely utilized for importing various 3D model formats into software applications. The risk implications are severe, as the attack vector can be initiated remotely without requiring prior authentication or elevated privileges. An attacker can achieve this by supplying a maliciously crafted 3D model file containing compressed blocks designed to trigger the out-of-bounds write during parsing.\nPublic exploits have already been released, increasing the likelihood of active exploitation in the wild. Despite prior notification via an issue report, the project maintainers have not yet responded or provided an official patch. Organizations and developers utilizing the affected version of Assimp face immediate risks and should implement defensive workarounds or restrict the processing of untrusted files until a vendor-supplied update is available.",
  "technicalDetails": "The vulnerability is a heap-based buffer overflow caused by improper handling of compressed data blocks during the parsing of model files. The root cause lies within the Assimp::Compression::decompressBlock function situated in the code/Common/Compression.cpp source file of the File Parser component. When processing a malformed or maliciously crafted asset file, the decompression routine fails to properly validate the size parameters of the input data against the allocated destination buffer on the heap.\nExploitation of this flaw is initiated remotely by inducing a target application to parse an untrusted 3D model file containing a specially crafted compression payload. No authentication or user privileges are required, as the vulnerability manifests during the standard file ingestion and parsing phase. As the Assimp::Compression::decompressBlock function executes, the lack of robust bounds checking allows the decompression algorithm to write past the boundaries of the heap-allocated buffer.\nThe attack flow proceeds as follows: First, the victim application loads a malicious asset file using the vulnerable Assimp library. Second, the parser encounters compressed data blocks and invokes Assimp::Compression::decompressBlock to unpack the stream. Third, due to manipulated size headers within the file, the function writes data exceeding the intended allocation size on the heap. Finally, this memory corruption overwrites adjacent heap metadata or critical application data structures, resulting in an immediate crash or potentially enabling arbitrary code execution under the context of the running application.\nThe vulnerable component is explicitly the File Parser within Assimp 17c12da. The payload behavior involves overflowing heap memory structures during block decompression. Post-exploitation impact ranges from application instability and denial of service to remote code execution, depending on the heap layout and the precision of the attacker-controlled input."
}