Description

A vulnerability was detected in Open Asset Import Library Assimp 17c12da. This affects the function Assimp::MDLImporter::AddBonesToNodeGraph_3DGS_MDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component Node Parser. The manipulation of the argument bones_num results in heap-based buffer overflow. The attack can be executed remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-17T02:16:41.033Z",
  "pubdate": "2026-08-17T02:16:41.033Z",
  "executiveSummary": "A heap-based buffer overflow vulnerability has been identified in the Open Asset Import Library (Assimp) commit 17c12da, specifically within the Node Parser component. The flaw resides in the Assimp::MDLImporter::AddBonesToNodeGraph_3DGS_MDL7 function located in code/AssetLib/MDL/MDLLoader.cpp. An unauthenticated remote attacker can exploit this vulnerability by supplying a maliciously crafted 3DGS MDL7 file containing a manipulated bones_num argument. Successful exploitation of this issue results in a heap-based buffer overflow, which can lead to application crashes, memory corruption, and potentially remote code execution within the context of the application utilizing the library. Given that the exploit is currently public and the project has not yet responded to early disclosure reports, the risk level is elevated. Attackers do not require prior privileges or authentication, provided they can trick a target user or system into processing a malignant 3D model file.",
  "technicalDetails": "The vulnerability is a classic heap-based buffer overflow stemming from improper validation of integer values and associated memory allocation sizes within the Assimp MDL parsing engine. The root cause lies in the handling of the bones_num argument inside the Assimp::MDLImporter::AddBonesToNodeGraph_3DGS_MDL7 function within code/AssetLib/MDL/MDLLoader.cpp.\nWhen Assimp processes a 3DGS MDL7 file, the parser extracts structural metadata regarding skeletal bones from the file headers and chunks. Specifically, the bones_num parameter dictates the expected number of bones and is used directly in calculations determining the size of heap memory allocations required to store bone references or node graph structures.\nBecause the function fails to adequately bound-check or sanitize the untrusted bones_num value read from the input file, an attacker can supply an excessively large integer or a value that results in an integer overflow during size calculations. Consequently, the memory allocation routine reserves insufficient heap space relative to the actual data copying operations that follow.\nDuring the subsequent parsing and population phase, the program writes bone data past the boundaries of the allocated heap buffer. This heap corruption overwrites adjacent heap metadata or application data structures, leading to immediate memory corruption.\nThe attack flow proceeds as follows: 1) The victim application invokes the Assimp loading routines on a maliciously crafted MDL file. 2) The parser reaches code/AssetLib/MDL/MDLLoader.cpp and invokes Assimp::MDLImporter::AddBonesToNodeGraph_3DGS_MDL7. 3) The malicious bones_num parameter is read without proper validation. 4) An improperly sized heap buffer is allocated. 5) Subsequent write operations overflow the heap buffer, triggering memory corruption. Network exposure depends on how the library is utilized; if exposed via a web service, file conversion utility, or thick client rendering engine that processes untrusted remote inputs, the attack can be executed remotely without authentication or privileges."
}