Description

A security vulnerability has been detected in Open Asset Import Library Assimp up to 6.0.2. The impacted element is the function MD5Importer::MakeDataUnique of the file code/AssetLib/MD5/MD5Loader.cpp. The manipulation of the argument iNewIndex leads to heap-based buffer overflow. The attack can only be performed from a local environment. The identifier of the patch is bf9dabb617c46e5133dac65cca6bff177917afcb. Applying a patch is the recommended action to fix this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-30T23:17:08.137Z",
  "pubdate": "2026-08-30T23:17:08.137Z",
  "executiveSummary": "A heap-based buffer overflow vulnerability has been identified in the Open Asset Import Library (Assimp), specifically within the MD5 format parsing logic.\nThe vulnerability resides in the MD5Importer::MakeDataUnique function located in code/AssetLib/MD5/MD5Loader.cpp.\nThe flaw allows for memory corruption triggered via a specifically crafted malformed MD5 input file.\nImpacted versions include Assimp up to 6.0.2.\nThe vulnerability requires local access to the target environment, as the attacker must provide a malicious file for processing by the application.\nSuccessful exploitation may lead to arbitrary code execution or a denial-of-service state depending on the control an attacker exerts over the heap layout.\nThe vulnerability poses significant risk in scenarios where Assimp is utilized to process untrusted assets or user-generated content.\nThe recommended remediation is the application of the official security patch identified by hash bf9dabb617c46e5133dac65cca6bff177917afcb.",
  "technicalDetails": "The vulnerability is a heap-based buffer overflow occurring during the data normalization phase of the MD5 model file import process.\nThe root cause is identified within the MD5Importer::MakeDataUnique function. This function is responsible for ensuring that vertex or mesh data is unique to prevent redundant processing or rendering errors.\nThe flaw manifests due to improper validation or calculation of the iNewIndex argument, which serves as a pointer or index into the dynamically allocated heap buffer.\nWhen processing malformed MD5 files, the logic within MakeDataUnique fails to enforce strict bounds checking on iNewIndex before performing operations on the destination buffer.\nThe attack flow initiates when an application using Assimp loads a malicious MD5 file. As the library iterates through the mesh definitions and calls MakeDataUnique, the specifically crafted input causes the iNewIndex argument to reference an address outside the intended allocation boundaries of the heap buffer.\nBecause the heap is a shared memory region, the out-of-bounds write allows an attacker to overwrite adjacent heap metadata or adjacent object data.\nIn highly controlled local environments, a sophisticated attacker could leverage this primitive to overwrite critical application objects or function pointers stored on the heap, potentially redirecting control flow to attacker-supplied shellcode or existing executable segments (ROP chains).\nAlternatively, if the overflow results in the corruption of heap metadata structures (such as chunk headers), the application will likely terminate due to a memory management exception, resulting in a denial-of-service (DoS) condition.\nThe vulnerability is restricted to local exploitation because the attacker must submit a malicious file directly to an application utilizing the affected Assimp version to trigger the vulnerable code path during file parsing.\nAssimp versions up to and including 6.0.2 are confirmed to be vulnerable.\nThe integrity of the parsing logic is fundamentally compromised when the function does not verify that the index provided by the file content remains within the pre-allocated memory constraints of the model's data arrays, leading to the heap-based memory safety violation."
}