Heap-based buffer overflow vulnerability in Assimp versions prior to 5.4.2 allows a local attacker to execute arbitrary code by inputting a specially crafted file into the product.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade assimp | Oct 1, 2024 | Jul 19, 2024 |
| Debian | — | Upgrade assimp | May 15, 2025 | Jul 19, 2024 |
| Suse | — | Upgrade libQt53DQuickRender-develUpgrade libQt53DQuickScene2D5Upgrade libQt53DQuickExtras5Upgrade libqt5-qtquick3d-toolsUpgrade libQt5Quick3DAssetImport5Upgrade libQt53DInput-develUpgrade libQt53DLogic-develUpgrade libqt5-qt3d-importsUpgrade libQt53DExtras-develUpgrade libQt53DAnimation5Upgrade libQt53DCore5Upgrade libQt53DAnimation-develUpgrade libQt53DQuickExtras-develUpgrade libQt53DQuickAnimation5Upgrade libQt53DQuickInput5Upgrade libassimp5Upgrade libQt53DQuickAnimation-develUpgrade libqt5-qt3d-develUpgrade libQt53DRender-develUpgrade libqt5-qtquick3d-develUpgrade libqt5-qtquick3d-private-headers-develUpgrade libQt53DQuick-develUpgrade libQt53DQuickScene2D-develUpgrade assimp-develUpgrade libQt53DQuick5Upgrade libQt53DRender5Upgrade libQt53DQuickRender5Upgrade libqt5-qt3d-examplesUpgrade libQt53DExtras5Upgrade libQt5Quick3D5Upgrade libqt5-qtquick3d-examplesUpgrade libQt53DQuickInput-develUpgrade libQt53DLogic5Upgrade libqt5-qt3d-toolsUpgrade libqt5-qt3d-private-headers-develUpgrade libQt53DInput5Upgrade libQt53DCore-develUpgrade libqt5-qtquick3d-imports | Jul 29, 2024 | Jul 19, 2024 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Jul 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub