Heap-use-after-free Vulnerability in Assimp Package
Summary
OSV-2025-373: Heap-use-after-free in aiMesh::~aiMesh. Affects assimp versions >= 9d9a80739df416d89bcd69e1f2532732269a7f67, < a38ec50fd3a8189d4ec0f0e9251f4203b312b9b6. Fixed in a38ec50fd3a8189d4ec0f0e9251f4203b312b9b6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Assimp (Open Asset Import Library) is a widely used library designed for importing and exporting various 3D model formats. It provides developers with a unified interface to handle different file types, making it easier to integrate 3D assets into applications. However, like many libraries, Assimp is susceptible to vulnerabilities that can compromise the integrity and security of applications that rely on it.
Vulnerability Detail
The vulnerability identified as OSV-2025-373 is a heap-use-after-free issue occurring in the aiMesh destructor. This flaw can lead to a crash when the library attempts to access memory that has already been freed, potentially allowing an attacker to exploit this behavior. The crash occurs during the destruction of aiMesh and aiScene objects, which are critical components in the processing of 3D models. If exploited, this vulnerability could lead to application instability or even arbitrary code execution in severe cases.
How To Fix
Minimum fixed version
a38ec50fd3a8189d4ec0f0e9251f4203b312b9b6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is advisable to update the package as soon as a patched version is available to mitigate any risks associated with this issue.
Conclusion
The heap-use-after-free vulnerability in the Assimp package poses significant risks to applications utilizing this library. It is crucial for developers to stay informed about such vulnerabilities and promptly apply updates to maintain the security and stability of their applications.
See every vulnerability recorded for assimp →
FAQ
A heap-use-after-free vulnerability occurs when a program continues to use a memory location after it has been freed, which can lead to crashes or arbitrary code execution.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The consequences can range from application crashes to potential exploitation by attackers, leading to unauthorized access or control over the affected system.
Always refer to the official Assimp repository for the latest patched version that addresses this vulnerability.
Yes, you can use the Vulert playground to check if your application is affected by this vulnerability without requiring any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for assimp.
