Every CVE Search/ Get API key

CVE-2024-48425

A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle:...

5.5 MediumFix available

A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode function within the Assimp library during fuzz testing using AddressSanitizer. The crash occurs due to a read access violation at address 0x000000000460, which points to the zero page, indicating a null or invalid pointer dereference.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.24%Up 0.2 points since Oct 25, 2024
90%50%10%1%

What each source reports

CVE List Score used 5.5

A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode function within the Assimp library during fuzz testing using AddressSanitizer. The crash occurs due to a read access violation at address 0x000000000460, which points to the zero page, indicating a null or invalid pointer dereference.

Record
CVE-2024-48425
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-120
Updated
2026-11-02
EUVDEUVD-2024-43009 5.5

A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode function within the Assimp library during fuzz testing using AddressSanitizer. The crash occurs due to a read access violation at address 0x000000000460, which points to the zero page, indicating a null or invalid pointer dereference.

Record
EUVD-2024-43009
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-5qr5-9jfv-96j2 5.5

A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle:...

A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode function within the Assimp library during fuzz testing using AddressSanitizer. The crash occurs due to a read access violation at address 0x000000000460, which points to the zero page, indicating a null or invalid pointer dereference.

Record
GHSA-5qr5-9jfv-96j2
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-120
Updated
2026-11-02
NVD 5.5

A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode function within the Assimp library during fuzz testing using AddressSanitizer. The crash occurs due to a read access violation at address 0x000000000460, which points to the zero page, indicating a null or invalid pointer dereference.

Record
CVE-2024-48425
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-120
Updated
2026-11-02
OSV 5.5

A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode function within the Assimp library during fuzz testing using AddressSanitizer. The crash occurs due to a read access violation at address 0x000000000460, which points to the zero page, indicating a null or invalid pointer dereference.

Record
CVE-2024-48425
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2024-48425 5.5

A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode function within the Assimp library during fuzz testing using AddressSanitizer. The crash occurs due to a read access violation at address 0x000000000460, which points to the zero page, indicating a null or invalid pointer dereference.

Record
DEBIAN-CVE-2024-48425
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVOESA-2024-2360 5.5

assimp security update

Assimp is a library to load and process geometric scenes from various data formats. Assimp aims to provide a full asset conversion pipeline for use in game engines and real-time rendering systems of any kind, but is not limited to this purpose.

Security Fix(es):

A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode function within the Assimp library during fuzz testing using AddressSanitizer. The crash occurs due to a read access violation at address 0x000000000460, which points to the zero page, indicating a null or invalid pointer dereference.(CVE-2024-48425)

Record
OESA-2024-2360
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVPYSEC-2024-293 5.5

A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode function within the Assimp library during fuzz testing using AddressSanitizer. The crash occurs due to a read access violation at address 0x000000000460, which points to the zero page, indicating a null or invalid pointer dereference.

Record
PYSEC-2024-293
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2024-48425 5.5

A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode function within the Assimp library during fuzz testing using AddressSanitizer. The crash occurs due to a read access violation at address 0x000000000460, which points to the zero page, indicating a null or invalid pointer dereference.

Record
UBUNTU-CVE-2024-48425
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2024:14610-1 No score

assimp-devel-5.4.3-3.1 on GA media

These are all security issues fixed in the assimp-devel-5.4.3-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14610-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:0113-1 No score

Security update for assimp

This update for assimp fixes the following issues:

  • CVE-2024-48425: Fixed SEGV in Assimp:SplitLargeMeshesProcess_Triangle:UpdateNode (boo#1232324)
  • CVE-2024-48423: Fixed a arbitrary code execution via CallbackToLogRedirector() (boo#1232322)
  • CVE-2024-48424: Fixed a heap-buffer-overflow in OpenDDLParser:parseStructure() (boo#1232323)
  • CVE-2024-53425: Fixed a heap-based buffer overflow in SkipSpacesAndLineEnd() (boo#1233633)
  • CVE-2025-2592: Fixed a heap-based buffer overflow in Assimp::CSMImporter::InternReadFile() (boo#1239916)
  • CVE-2025-3015: Fixed out-of-bounds read caused by manipulation of the argument mIndices (boo#1240412)
  • CVE-2025-3016: Fixed a denial of service caused by manipulation of the argument mWidth/mHeight (boo#1240413)
  • CVE-2025-2591: Fixed a denial of service in code/AssetLib/MDL/MDLLoader.cpp (boo#1239920)
  • CVE-2025-2151: Fixed a stack-based buffer overflow in Assimp::GetNextLine() (boo#1239220)
Record
openSUSE-SU-2025:0113-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
assimp
Debian:12
 All versions, plus listed versions
5.2.5~ds0-15.2.5~ds0-1.15.3.1+ds-15.3.1+ds-25.4.0+ds-1
Show 9 moreShow less
5.4.1+ds-15.4.2+ds-15.4.3+ds-25.4.3+ds-36.0.2+ds-16.0.3+ds-16.0.4+ds-16.0.4+ds-36.0.5+ds-1
 None known
assimp
Debian:13
 All versions, plus listed versions
5.4.3+ds-25.4.3+ds-36.0.2+ds-16.0.3+ds-16.0.4+ds-16.0.4+ds-36.0.5+ds-1
 None known
assimp
Debian:14
 before 6.0.2+ds-1, plus listed versions
5.4.3+ds-25.4.3+ds-3
6.0.2+ds-1
assimp
openEuler:22.03-LTS-SP3
 before 5.2.4-4.oe2203sp3
5.2.4-4.oe2203sp3
assimp
openEuler:20.03-LTS-SP4
 before 3.3.1-21.oe2003sp4
3.3.1-21.oe2003sp4
assimp
openEuler:22.03-LTS-SP1
 before 5.2.4-4.oe2203sp1
5.2.4-4.oe2203sp1
assimp
openEuler:24.03-LTS
 before 5.3.1-5.oe2403
5.3.1-5.oe2403
assimp
openEuler:22.03-LTS-SP4
 before 5.2.4-4.oe2203sp4
5.2.4-4.oe2203sp4
pyassimp
PyPI
 through 5.4.3, plus listed versions
0.13.34.1.14.1.24.1.34.1.45.2.5
 None known
assimp
Ubuntu:16.04:LTS
 All versions, plus listed versions
3.0~dfsg-4ubuntu43.1.1~dfsg-53.2~dfsg-13.2~dfsg-23.2~dfsg-3
 None known
Show 28 moreShow less
Affected packages
PackageAffectedFixed
spring
Ubuntu:16.04:LTS
 All versions, plus listed versions
100.0+dfsg-2100.0+dfsg-2build1
 None known
assimp
Ubuntu:18.04:LTS
 All versions, plus listed versions
3.3.1~dfsg-53.3.1~dfsg-5ubuntu13.3.1~dfsg-5+build14.0.1~dfsg-1~exp24.0.1~dfsg-14.1.0~dfsg-14.1.0~dfsg-24.1.0~dfsg-3
 None known
spring
Ubuntu:18.04:LTS
 All versions, plus listed versions
103.0+dfsg2-1103.0+dfsg2-1build1104.0+dfsg-2
 None known
assimp
Ubuntu:20.04:LTS
 All versions, plus listed versions
4.1.0~dfsg-54.1.0~dfsg-5ubuntu15.0.1~ds0-1build1
 None known
spring
Ubuntu:20.04:LTS
 All versions, plus listed versions
104.0+dfsg-3build2104.0+dfsg-4ubuntu1104.0+dfsg-4ubuntu2104.0+dfsg-4ubuntu5104.0+dfsg-4ubuntu6104.0+dfsg-4ubuntu7
 None known
assimp
Ubuntu:22.04:LTS
 All versions, plus listed versions
5.0.1~ds0-25.0.1~ds0-3ubuntu15.1.4~ds0-15.1.5~ds0-15.1.6~ds0-15.2.0~ds0-25.2.1~ds0-15.2.2~ds0-1
 None known
qt6-3d
Ubuntu:22.04:LTS
 All versions, plus listed versions
6.2.2+dfsg-36.2.4+dfsg-1
 None known
qt6-quick3d
Ubuntu:22.04:LTS
 All versions, plus listed versions
6.2.2-36.2.2-46.2.4-1
 None known
spring
Ubuntu:22.04:LTS
 All versions, plus listed versions
105.0.1+dfsg-2105.0.1+dfsg-3ubuntu1105.0.1+dfsg-3ubuntu2105.0.1+dfsg-4
 None known
assimp
Ubuntu:24.04:LTS
 All versions, plus listed versions
5.2.5~ds0-1.1build15.3.1+ds-15.3.1+ds-25.3.1+ds-2build1
 None known
qt6-3d
Ubuntu:24.04:LTS
 All versions, plus listed versions
6.4.2+dfsg-66.4.2+dfsg-6build16.4.2+dfsg-6build26.4.2+dfsg-6build3
 None known
qt6-quick3d
Ubuntu:24.04:LTS
 All versions, plus listed versions
6.4.2-36.4.2-3build16.4.2-3build26.4.2-3build3
 None known
spring
Ubuntu:24.04:LTS
 All versions, plus listed versions
106.0+dfsg-2106.0+dfsg-3106.0+dfsg-3build2106.0+dfsg-3build3
 None known
assimp
Ubuntu:25.10
 All versions, plus listed versions
5.4.3+ds-2
 None known
qt6-3d
Ubuntu:25.10
 All versions, plus listed versions
6.8.3+dfsg-0ubuntu16.9.2+dfsg-1
 None known
qt6-quick3d
Ubuntu:25.10
 All versions, plus listed versions
6.8.3-0ubuntu16.9.2-1
 None known
spring
Ubuntu:25.10
 All versions, plus listed versions
106.0+dfsg-4
 None known
assimp
Ubuntu:26.10
 All versions, plus listed versions
6.0.4+ds-1build16.0.5+ds-1
 None known
qt6-3d
Ubuntu:26.10
 All versions, plus listed versions
6.10.2+dfsg-16.10.2+dfsg-36.11.2+dfsg-1
 None known
qt6-quick3d
Ubuntu:26.10
 All versions, plus listed versions
6.10.2-16.10.2-36.11.2-2
 None known
spring
Ubuntu:26.10
 All versions, plus listed versions
106.0+dfsg-4106.0+dfsg-5
 None known
assimp
Ubuntu:26.04:LTS
 All versions, plus listed versions
5.4.3+ds-26.0.2+ds-16.0.3+ds-16.0.4+ds-16.0.4+ds-1build1
 None known
qt6-3d
Ubuntu:26.04:LTS
 All versions, plus listed versions
6.9.2+dfsg-16.9.2+dfsg-1build16.10.2+dfsg-1
 None known
qt6-quick3d
Ubuntu:26.04:LTS
 All versions, plus listed versions
6.9.2-16.9.2-1build16.9.2-56.9.2-5build16.10.2-1
 None known
spring
Ubuntu:26.04:LTS
 All versions, plus listed versions
106.0+dfsg-4
 None known
assimp
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 5.4.3-3.1
5.4.3-3.1
assimp
SUSE:Package Hub 15 SP6
From an advisory covering 9 CVEs
 before 5.3.1-bp156.3.9.1
5.3.1-bp156.3.9.1
assimp
openSUSE:Leap 15.6
From an advisory covering 9 CVEs
 before 5.3.1-bp156.3.9.1
5.3.1-bp156.3.9.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-48425 is a medium vulnerability (CVSS 5.5) in Assimp, published October 24, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 15th percentile. Fixed in assimp 6.0.2+ds-1.

References

Show 22 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open