Stack-Use-After-Scope Vulnerability in Assimp Package
Summary
OSV-2025-965: Stack-use-after-scope in Assimp::FBX::FBXExportProperty::FBXExportProperty. Affects assimp versions >= ac0cfc8d9cd2ebfa959053d822e4846a814cf053, < 970f8691dd5e54bd7667438efe5f2cd8e261d199. Fixed in 970f8691dd5e54bd7667438efe5f2cd8e261d199. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Assimp, short for Open Asset Import Library, is a popular open-source library designed to facilitate the import and export of various 3D model formats. It provides developers with a unified interface to load and manipulate 3D assets, making it easier to integrate complex models into applications. However, like many libraries, it is susceptible to vulnerabilities that can compromise application security and stability. The recent stack-use-after-scope vulnerability highlights a critical issue in the FBX export functionality of Assimp, which could lead to unexpected behavior or crashes.
Vulnerability Detail
The vulnerability identified as a stack-use-after-scope occurs within the Assimp::FBX::FBXExportProperty constructor. This issue arises when the code attempts to access memory that has already been freed, leading to potential crashes or exploitation. The origin of this vulnerability was reported through OSS-Fuzz, indicating that it can be triggered during the export of FBX objects. The ramifications include application crashes and possible exploitation by malicious actors, making it essential for developers to address this issue promptly.
How To Fix
Minimum fixed version
970f8691dd5e54bd7667438efe5f2cd8e261d199
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can avoid using the FBX export functionality until the package is updated. This may involve modifying the application to use alternative export formats or methods that do not invoke the vulnerable code.
Conclusion
The stack-use-after-scope vulnerability in the Assimp package poses significant risks to applications utilizing its FBX export functionality. Developers are urged to update to the patched version to mitigate these risks. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time, ensuring the security of your software.
See every vulnerability recorded for assimp →
FAQ
A stack-use-after-scope vulnerability occurs when a program continues to use a pointer to a stack variable after it has gone out of scope, potentially leading to crashes or security issues.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By uploading your manifest file, such as package-lock.json, you can check for vulnerabilities without needing to access the code.
Failing to address this vulnerability can lead to application crashes, data corruption, and potential exploitation by attackers, compromising the security of your application.
Yes, you can temporarily avoid using the affected functionality, such as FBX export, until the package is updated to a secure version.
Detailed information about the vulnerability can be found in the OSS-Fuzz report at https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=465494996.
References
Related vulnerabilities
Recent vulnerabilities recorded for assimp.
