Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Assimp: Malicious Files Can Crash or Steal Data
published 6 months ago
Summary
The Assimp library, used to load 3D models, has a security update to fix a flaw that could allow hackers to crash the program or steal sensitive information. This issue affects Assimp version 5.4.3 and higher. Users should update to the latest version to prevent potential attacks.
What to do
- Update openeuler assimp to version 5.2.4-15.oe2203sp4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| openEuler:22.03-LTS-SP4 | openeuler | assimp |
< 5.2.4-15.oe2203sp4 Fix: upgrade to 5.2.4-15.oe2203sp4
|
Original advisory text
assimp security update
Assimp is a library to load and process geometric scenes from various data formats. Assimp aims to provide a full asset conversion pipeline for use in game engines and real-time rendering systems of any kind, but is not limited to this purpose.
Security Fix(es):
A heap-buffer-overflow vulnerability has been identified in the OpenDDLParser::parseStructure function within the Assimp library, specifically during the processing of OpenGEX files.(CVE-2024-48424)
A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. The manipulation of the argument na leads to out-of-bounds read. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.(CVE-2025-2751)
Security Fix(es):
A heap-buffer-overflow vulnerability has been identified in the OpenDDLParser::parseStructure function within the Assimp library, specifically during the processing of OpenGEX files.(CVE-2024-48424)
A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. The manipulation of the argument na leads to out-of-bounds read. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.(CVE-2025-2751)
References
- https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-48424 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-2751 Vendor Advisory
Timeline
Published25 Apr 2026
Updated25 Apr 2026
First seen25 Apr 2026
Sources
OESA-2026-2054 · OSV
Track software like this
Free during beta