Description

A weakness has been identified in Open Asset Import Library Assimp 17c12da. The affected element is the function Assimp::MDLImporter::ReadFaces_3DGS_MDL7 in the library code/AssetLib/LWO/LWOLoader.h of the component 3DGS MDL7 Model Parser. Executing a manipulation can lead to heap-based buffer overflow. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. This patch is called ee77bb09a42a49843ac85ef64c14d2328b251df1. Applying a patch is advised to resolve this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-17T01:16:44.560Z",
  "pubdate": "2026-08-17T01:16:44.560Z",
  "executiveSummary": "A heap-based buffer overflow vulnerability has been identified in the Open Asset Import Library (Assimp) commit 17c12da. The flaw resides within the 3DGS MDL7 Model Parser component, specifically inside the Assimp::MDLImporter::ReadFaces_3DGS_MDL7 function located in code/AssetLib/LWO/LWOLoader.h. This vulnerability allows remote attackers to trigger memory corruption by supplying a maliciously crafted model file. Successful exploitation can lead to arbitrary code execution, application crashes, or denial of service conditions within software utilizing the affected Assimp library. Given that public exploits are available, the risk to systems processing untrusted 3D assets is critical. No specific authentication or elevated privileges are required to launch the attack, making remote exploitation feasible if an application parses untrusted input files.",
  "technicalDetails": "The vulnerability is a heap-based buffer overflow stemming from improper bounds checking and memory allocation logic within the Assimp::MDLImporter::ReadFaces_3DGS_MDL7 function in code/AssetLib/LWO/LWOLoader.h. During the parsing of 3DGS MDL7 model files, the parser processes face data structures where input values derived from the file headers or stream content dictate loop boundaries and memory copy sizes without adequate validation against the allocated heap buffer dimensions.\nThe attack vector involves a remote adversary delivering a malformed 3DGS MDL7 file to an application leveraging the Open Asset Import Library. When the vulnerable function reads face indices or vertex references from the crafted asset, the lack of rigorous size verification causes a write operation to exceed the boundaries of the heap-allocated buffer. This results in contiguous heap memory corruption, overwriting adjacent heap metadata or application data structures.\nExploitation requires no prior authentication or user privileges beyond the ability to supply a malicious file to the target parsing routine. Network exposure depends on the architecture of the host application, but web services, asset conversion pipelines, and game engines that automatically process remote uploads or downloaded 3D models are directly exposed. The payload behavior during exploitation typically involves overwriting heap chunks to redirect execution flow or destabilize the runtime environment, leading to application crashes or potential remote code execution under the security context of the process.\nThe official remediation for this issue is addressed by commit ee77bb09a42a49843ac85ef64c14d2328b251df1, which introduces necessary boundary checks and secure memory handling within the affected parser code."
}