Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.4

Assimp 5.4.2 and earlier allows local code execution via crafted file

CVE-2024-45679 · published 2 years ago
Summary

A security issue exists in older versions of Assimp, a 3D model importer, which could allow a malicious user to run unauthorized code on a local system. If you use Assimp, update to version 5.4.3 or later to fix this issue. Consider patching or upgrading your application that relies on Assimp to ensure it uses a secure version.

What to do
  • Update debian assimp to version 5.4.0+ds-1.
  • Update assimp assimp to version 5.4.3 or later.
Affected software
Ecosystem VendorProductAffected versions
– assimp assimp < 5.4.3
cpe:2.3:a:assimp:assimp:*:*:*:*:*:*:*:*
Debian:12 debian assimp All versions
Debian:13 debian assimp < 5.4.0+ds-1
Fix: upgrade to 5.4.0+ds-1
Debian:14 debian assimp < 5.4.0+ds-1
Fix: upgrade to 5.4.0+ds-1
Ubuntu:16.04:LTS canonical assimp All versions
Original advisory text
Heap-based buffer overflow vulnerability in Assimp versions prior to 5.4.3 allows a local attacker to execute arbitrary code by importing a specially crafted file into the product.
Heap-based buffer overflow vulnerability in Assimp versions prior to 5.4.3 allows a local attacker to execute arbitrary code by importing a specially crafted file into the product.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.4 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-122Heap-based Buffer Overflow
Timeline
Published18 Sep 2024
Updated3 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-45679 · NVD
CVE-2024-45679 · OSV
DEBIAN-CVE-2024-45679 · OSV
UBUNTU-CVE-2024-45679 · OSV
Track software like this
Free during beta