CVE-2024-48423

An issue in assimp v.5.4.3 allows a local attacker to execute arbitrary code via the...

7.8 HighFix available

An issue in assimp v.5.4.3 allows a local attacker to execute arbitrary code via the CallbackToLogRedirector function within the Assimp library.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.26%Up 0.2 points since Oct 25, 2024

What each source reports

NVD Score used 7.8

An issue in assimp v.5.4.3 allows a local attacker to execute arbitrary code via the CallbackToLogRedirector function within the Assimp library.

Record: CVE-2024-48423
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1: 8.4 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

CVE List 8.4

An issue in assimp v.5.4.3 allows a local attacker to execute arbitrary code via the CallbackToLogRedirector function within the Assimp library.

Record: CVE-2024-48423
CVSS 3.1: 8.4 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

EUVDEUVD-2024-0152 8.4

An issue in assimp v.5.4.3 allows a local attacker to execute arbitrary code via the CallbackToLogRedirector function within the Assimp library.

Record: EUVD-2024-0152
CVSS 3.1: 8.4 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-mjhm-5r72-mjx7 7.8

An issue in assimp v.5.4.3 allows a local attacker to execute arbitrary code via the...

An issue in assimp v.5.4.3 allows a local attacker to execute arbitrary code via the CallbackToLogRedirector function within the Assimp library.

Record: GHSA-mjhm-5r72-mjx7
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

OSV 8.4

An issue in assimp v.5.4.3 allows a local attacker to execute arbitrary code via the CallbackToLogRedirector function within the Assimp library.

Record: CVE-2024-48423
CVSS 3.1: 8.4 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2024-48423 7.8

An issue in assimp v.5.4.3 allows a local attacker to execute arbitrary code via the CallbackToLogRedirector function within the Assimp library.

Record: DEBIAN-CVE-2024-48423
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 6 moreShow less

OSVOESA-2025-1602 7.8

assimp security update

Assimp is a library to load and process geometric scenes from various data formats. Assimp aims to provide a full asset conversion pipeline for use in game engines and real-time rendering systems of any kind, but is not limited to this purpose.

Security Fix(es):

An issue in assimp v.5.4.3 allows a local attacker to execute arbitrary code via the CallbackToLogRedirector function within the Assimp library.(CVE-2024-48423)

Record: OESA-2025-1602
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2025-1603 7.8

assimp security update

Security Fix(es):

An issue in assimp v.5.4.3 allows a local attacker to execute arbitrary code via the CallbackToLogRedirector function within the Assimp library.(CVE-2024-48423)

Record: OESA-2025-1603
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVPYSEC-2024-120 7.8

An issue in assimp v.5.4.3 allows a local attacker to execute arbitrary code via the CallbackToLogRedirector function within the Assimp library.

Record: PYSEC-2024-120
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2024-48423 8.4

An issue in assimp v.5.4.3 allows a local attacker to execute arbitrary code via the CallbackToLogRedirector function within the Assimp library.

Record: UBUNTU-CVE-2024-48423
CVSS 3.1: 8.4 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVopenSUSE-SU-2024:14610-1 No score

assimp-devel-5.4.3-3.1 on GA media

These are all security issues fixed in the assimp-devel-5.4.3-3.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:14610-1
Updated: 2026-11-02

OSVopenSUSE-SU-2025:0113-1 No score

Security update for assimp

This update for assimp fixes the following issues:

CVE-2024-48425: Fixed SEGV in Assimp:SplitLargeMeshesProcess_Triangle:UpdateNode (boo#1232324)
CVE-2024-48423: Fixed a arbitrary code execution via CallbackToLogRedirector() (boo#1232322)
CVE-2024-48424: Fixed a heap-buffer-overflow in OpenDDLParser:parseStructure() (boo#1232323)
CVE-2024-53425: Fixed a heap-based buffer overflow in SkipSpacesAndLineEnd() (boo#1233633)
CVE-2025-2592: Fixed a heap-based buffer overflow in Assimp::CSMImporter::InternReadFile() (boo#1239916)
CVE-2025-3015: Fixed out-of-bounds read caused by manipulation of the argument mIndices (boo#1240412)
CVE-2025-3016: Fixed a denial of service caused by manipulation of the argument mWidth/mHeight (boo#1240413)
CVE-2025-2591: Fixed a denial of service in code/AssetLib/MDL/MDLLoader.cpp (boo#1239920)
CVE-2025-2151: Fixed a stack-based buffer overflow in Assimp::GetNextLine() (boo#1239220)

Record: openSUSE-SU-2025:0113-1
Updated: 2026-11-02

Affected products

assimp

Affected packages

Affected packages
Package	Affected	Fixed
`assimp` Debian:12	All versions, plus listed versions 5.2.5~ds0-15.2.5~ds0-1.15.3.1+ds-15.3.1+ds-25.4.0+ds-1 Show 9 moreShow less 5.4.1+ds-15.4.2+ds-15.4.3+ds-25.4.3+ds-36.0.2+ds-16.0.3+ds-16.0.4+ds-16.0.4+ds-36.0.5+ds-1	None known
`assimp` Debian:13	All versions, plus listed versions 5.4.3+ds-25.4.3+ds-36.0.2+ds-16.0.3+ds-16.0.4+ds-16.0.4+ds-36.0.5+ds-1	None known
`assimp` Debian:14	before 6.0.2+ds-1, plus listed versions 5.4.3+ds-25.4.3+ds-3	6.0.2+ds-1
`assimp` openEuler:24.03-LTS	before 5.3.1-9.oe2403	5.3.1-9.oe2403
`assimp` openEuler:24.03-LTS-SP1	before 5.3.1-9.oe2403sp1	5.3.1-9.oe2403sp1
`pyassimp` PyPI	All versions, plus listed versions 0.13.34.1.14.1.24.1.34.1.45.2.5	None known
`assimp` Ubuntu:16.04:LTS	All versions, plus listed versions 3.0~dfsg-4ubuntu43.1.1~dfsg-53.2~dfsg-13.2~dfsg-23.2~dfsg-3	None known
`assimp` Ubuntu:18.04:LTS	All versions, plus listed versions 3.3.1~dfsg-53.3.1~dfsg-5ubuntu13.3.1~dfsg-5+build14.0.1~dfsg-1~exp24.0.1~dfsg-14.1.0~dfsg-14.1.0~dfsg-24.1.0~dfsg-3	None known
`assimp` Ubuntu:20.04:LTS	All versions, plus listed versions 4.1.0~dfsg-54.1.0~dfsg-5ubuntu15.0.1~ds0-1build1	None known
`assimp` Ubuntu:22.04:LTS	All versions, plus listed versions 5.0.1~ds0-25.0.1~ds0-3ubuntu15.1.4~ds0-15.1.5~ds0-15.1.6~ds0-15.2.0~ds0-25.2.1~ds0-15.2.2~ds0-1	None known

Show 17 moreShow less

Affected packages
Package	Affected	Fixed
`qt6-3d` Ubuntu:22.04:LTS	All versions, plus listed versions 6.2.2+dfsg-36.2.4+dfsg-1	None known
`qt6-quick3d` Ubuntu:22.04:LTS	All versions, plus listed versions 6.2.2-36.2.2-46.2.4-1	None known
`assimp` Ubuntu:24.04:LTS	All versions, plus listed versions 5.2.5~ds0-1.1build15.3.1+ds-15.3.1+ds-25.3.1+ds-2build1	None known
`qt6-3d` Ubuntu:24.04:LTS	All versions, plus listed versions 6.4.2+dfsg-66.4.2+dfsg-6build16.4.2+dfsg-6build26.4.2+dfsg-6build3	None known
`qt6-quick3d` Ubuntu:24.04:LTS	All versions, plus listed versions 6.4.2-36.4.2-3build16.4.2-3build26.4.2-3build3	None known
`assimp` Ubuntu:25.10	All versions, plus listed versions 5.4.3+ds-2	None known
`qt6-3d` Ubuntu:25.10	All versions, plus listed versions 6.8.3+dfsg-0ubuntu16.9.2+dfsg-1	None known
`qt6-quick3d` Ubuntu:25.10	All versions, plus listed versions 6.8.3-0ubuntu16.9.2-1	None known
`assimp` Ubuntu:26.10	All versions, plus listed versions 6.0.4+ds-1build16.0.5+ds-1	None known
`qt6-3d` Ubuntu:26.10	All versions, plus listed versions 6.10.2+dfsg-16.10.2+dfsg-36.11.2+dfsg-1	None known
`qt6-quick3d` Ubuntu:26.10	All versions, plus listed versions 6.10.2-16.10.2-36.11.2-2	None known
`assimp` Ubuntu:26.04:LTS	All versions, plus listed versions 5.4.3+ds-26.0.2+ds-16.0.3+ds-16.0.4+ds-16.0.4+ds-1build1	None known
`qt6-3d` Ubuntu:26.04:LTS	All versions, plus listed versions 6.9.2+dfsg-16.9.2+dfsg-1build16.10.2+dfsg-1	None known
`qt6-quick3d` Ubuntu:26.04:LTS	All versions, plus listed versions 6.9.2-16.9.2-1build16.9.2-56.9.2-5build16.10.2-1	None known
`assimp` openSUSE:Tumbleweed From an advisory covering 4 CVEs	before 5.4.3-3.1	5.4.3-3.1
`assimp` SUSE:Package Hub 15 SP6 From an advisory covering 9 CVEs	before 5.3.1-bp156.3.9.1	5.3.1-bp156.3.9.1
`assimp` openSUSE:Leap 15.6 From an advisory covering 9 CVEs	before 5.3.1-bp156.3.9.1	5.3.1-bp156.3.9.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-48423 is a high vulnerability (CVSS 7.8) in Assimp, published October 24, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 17th percentile. Fixed in assimp 6.0.2+ds-1.

References

Show 23 moreShow less