Description
Assimp through 6.0.5 contains an integer overflow vulnerability in MD2Importer::ValidateHeader() that allows attackers to bypass frame table bounds checks using crafted header fields. Attackers can supply a malicious .md2 file whose numFrames and numVertices values wrap the 32-bit size check, causing heap out-of-bounds reads that crash applications or expose adjacent heap memory.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
assimp assimp
Default version status: unaffected
0 to ≤ 6.0.5affected
pkg:github/assimp/assimpReferences
- https://github.com/assimp/assimp/issues/6929 ↗
- https://github.com/assimp/assimp/pull/6963 ↗
- https://github.com/assimp/assimp/commit/7dbc85d9218fae017d4fad70269e7569f7b0c870 ↗
- https://github.com/assimp/assimp/blob/v6.0.5/code/AssetLib/MD2/MD2Loader.cpp#L171-L176 ↗
- https://github.com/assimp/assimp ↗
- https://www.vulncheck.com/advisories/assimp-through-6.0.5-heap-out-of-bounds-read-via-md2-importer-integer-overflow ↗