Assimp Buffer Overflow and Memory Corruption Flaws

Heap-based buffer overflow in Open Asset Import Library (Assimp) commit 17c12da enables remote attackers to corrupt memory by supplying a crafted file processed by the decompressBlock routine in Compression.cpp. Any application embedding Assimp for 3D asset import is exposed when a user opens a malicious model file, making this a supply-chain-style risk across game engines, editors, and design tools that depend on the library. No vendor patch exists at time of analysis - the project was notified via GitHub issue #6624 but has not responded - and a public proof-of-concept archive has already been released, lowering the barrier to exploitation.

Heap-based buffer overflow in Assimp's 3DGS MDL7 model parser allows remote attackers to crash applications processing maliciously crafted model files, causing a denial-of-service condition. The flaw resides in the ReadFaces_3DGS_MDL7 function and affects all Assimp versions through commit 17c12da (CPE wildcard-versioned), with a public proof-of-concept exploit already circulating on GitHub. No active exploitation is confirmed in CISA KEV; the CVSS 4.0 score of 5.3 (Medium) reflects availability-only impact gated by passive user interaction.

Buffer overflow in Open Asset Import Library (Assimp) commit 17c12da allows remote attackers to corrupt memory by delivering a maliciously crafted MDL7 3D model file to a victim application. The vulnerable function `GenerateOutputMeshes_3DGS_MDL7` in `MDLLoader.cpp` fails to enforce buffer bounds during mesh generation, resulting in low-severity integrity and availability impact per CVSS 4.0 (score: 2.1). A public proof-of-concept exploit has been disclosed; no vendor patch exists as the project has not responded to the coordinated disclosure.

Heap-based buffer overflow in Open Asset Import Library (Assimp) at commit 17c12da allows remote attackers to corrupt heap memory by supplying a crafted MDL7 3DGS format file that triggers out-of-bounds writes in the AddBonesToNodeGraph_3DGS_MDL7 function via a manipulated bones_num argument. Any application embedding Assimp that accepts untrusted 3D model files is exposed, with no vendor patch released as the project has not responded to disclosure. A publicly available proof-of-concept exploit exists, meaningfully lowering the exploitation bar for opportunistic attackers.