{"id":"CVE-2024-40724","aliases":["ALPINE-CVE-2024-40724","DEBIAN-CVE-2024-40724","EUVD-2024-38589","GHSA-rvvf-rc7q-23qm","JLSEC-2026-187","MGASA-2024-0300","OESA-2024-1910","OESA-2024-1911","OESA-2024-1912","OESA-2024-1913","SUSE-SU-2024:2975-1","SUSE-SU-2024:2976-1","SUSE-SU-2024:2984-1","SUSE-SU-2024:2985-1","SUSE-SU-2024:3078-1","SUSE-SU-2024:3079-1","UBUNTU-CVE-2024-40724","openSUSE-SU-2024:0225-1","openSUSE-SU-2024:14329-1"],"status":"published","title":"Heap-based buffer overflow vulnerability in Assimp versions prior to 5.4.2 allows a local...","description":"Heap-based buffer overflow vulnerability in Assimp versions prior to 5.4.2 allows a local attacker to execute arbitrary code by inputting a specially crafted file into the product.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00281,"percentile":0.20883,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-120","CWE-787"],"published":"2024-07-19T07:38:28Z","modified":"2026-11-03T06:32:08Z","fixes":[{"ecosystem":"Alpine:v3.20","package":"assimp","fixed_in":["5.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"assimp","fixed_in":["5.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"assimp","fixed_in":["5.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"assimp","fixed_in":["5.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"assimp","fixed_in":["5.4.3-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"assimp","fixed_in":["5.4.2+ds-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"assimp","fixed_in":["5.4.2+ds-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"assimp_jll","fixed_in":["6.0.4+0"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"assimp","fixed_in":["5.2.2-4.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"assimp","fixed_in":["5.3.1-3.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"assimp","fixed_in":["5.2.4-2.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"assimp","fixed_in":["5.2.4-2.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"assimp","fixed_in":["5.2.4-2.oe2203sp1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"libqt5-qt3d","fixed_in":["5.12.7-150200.4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"libqt5-qt3d","fixed_in":["5.12.7-150200.4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"libqt5-qt3d","fixed_in":["5.12.7-150200.4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"libqt5-qt3d","fixed_in":["5.12.7-150200.4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"libqt5-qt3d","fixed_in":["5.12.7-150200.4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"libqt5-qt3d","fixed_in":["5.12.7-150200.4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"libqt5-qt3d","fixed_in":["5.12.7-150200.4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libqt5-qt3d","fixed_in":["5.15.2+kde39-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libqt5-qt3d","fixed_in":["5.15.2+kde39-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libqt5-qt3d","fixed_in":["5.15.2+kde39-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libqt5-qt3d","fixed_in":["5.15.2+kde39-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"libqt5-qt3d","fixed_in":["5.15.12+kde0-150600.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"libqt5-qt3d","fixed_in":["5.15.12+kde0-150600.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"libqt5-qtquick3d","fixed_in":["5.15.12+kde1-150600.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"libqt5-qtquick3d","fixed_in":["5.15.12+kde1-150600.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"libqt5-qtquick3d","fixed_in":["5.15.8+kde1-150500.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"libqt5-qtquick3d","fixed_in":["5.15.8+kde1-150500.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"libqt5-qt3d","fixed_in":["5.15.8+kde0-150500.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"libqt5-qt3d","fixed_in":["5.15.8+kde0-150500.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP5","package":"assimp","fixed_in":["5.3.1-bp156.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP6","package":"assimp","fixed_in":["5.3.1-bp156.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"assimp","fixed_in":["5.3.1-bp156.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"assimp","fixed_in":["5.3.1-bp156.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"assimp","fixed_in":["5.4.3-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.20","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.3-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.5~ds0-1","5.2.5~ds0-1.1","5.3.1+ds-1","5.3.1+ds-2","5.4.0+ds-1","5.4.1+ds-1","5.4.2+ds-1","5.4.3+ds-2","5.4.3+ds-3","6.0.2+ds-1","6.0.3+ds-1","6.0.4+ds-1","6.0.4+ds-3","6.0.5+ds-1"]},{"source":"osv","ecosystem":"Debian:13","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2+ds-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2+ds-1"}]}]},{"source":"osv","ecosystem":"Julia","package":"assimp_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.0.4+0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-4.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1-3.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.4-2.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.4-2.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.4-2.oe2203sp1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"libqt5-qt3d","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.7-150200.4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"libqt5-qt3d","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.7-150200.4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"libqt5-qt3d","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.7-150200.4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"libqt5-qt3d","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.7-150200.4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"libqt5-qt3d","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.7-150200.4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"libqt5-qt3d","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.7-150200.4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"libqt5-qt3d","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.7-150200.4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libqt5-qt3d","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.2+kde39-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libqt5-qt3d","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.2+kde39-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libqt5-qt3d","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.2+kde39-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libqt5-qt3d","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.2+kde39-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"libqt5-qt3d","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.12+kde0-150600.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"libqt5-qt3d","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.12+kde0-150600.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"libqt5-qtquick3d","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.12+kde1-150600.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"libqt5-qtquick3d","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.12+kde1-150600.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"libqt5-qtquick3d","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.8+kde1-150500.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"libqt5-qtquick3d","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.8+kde1-150500.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"libqt5-qt3d","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.8+kde0-150500.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"libqt5-qt3d","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.8+kde0-150500.3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0~dfsg-4ubuntu4","3.1.1~dfsg-5","3.2~dfsg-1","3.2~dfsg-2","3.2~dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.1~dfsg-5","3.3.1~dfsg-5ubuntu1","3.3.1~dfsg-5+build1","4.0.1~dfsg-1~exp2","4.0.1~dfsg-1","4.1.0~dfsg-1","4.1.0~dfsg-2","4.1.0~dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.0~dfsg-5","4.1.0~dfsg-5ubuntu1","5.0.1~ds0-1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.1~ds0-2","5.0.1~ds0-3ubuntu1","5.1.4~ds0-1","5.1.5~ds0-1","5.1.6~ds0-1","5.2.0~ds0-2","5.2.1~ds0-1","5.2.2~ds0-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.5~ds0-1.1build1","5.3.1+ds-1","5.3.1+ds-2","5.3.1+ds-2build1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1-bp156.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP6","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1-bp156.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1-bp156.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1-bp156.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.3-1.1"}]}]}],"products":[{"vendor":"assimp","product":"assimp"},{"vendor":"open asset import library","product":"assimp"},{"vendor":"open_asset_import_library","product":"open_asset_import_library"}],"references":[{"url":"https://github.com/assimp/assimp/releases/tag/v5.4.2","tags":["x_transferred","Release Notes","web","report"]},{"url":"https://github.com/assimp/assimp/pull/5651/commits/614911bb3b1bfc3a1799ae2b3cca306270f3fb97","tags":["x_transferred","Patch","web","report"]},{"url":"https://jvn.jp/en/jp/JVN87710540/","tags":["x_transferred","Third Party Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-40724","tags":["advisory"]},{"url":"https://jvn.jp/en/jp/JVN87710540"},{"url":"https://github.com/advisories/GHSA-rvvf-rc7q-23qm"},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-40724","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/40xxx/CVE-2024-40724.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-40724","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0300.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33531","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GRHXRZKHWQMKKB7V55J2TDPZAKJSN2BF/","tags":["web","advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1910","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1911","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1912","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1913","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242975-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1228204","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40724","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242976-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242984-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242985-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1228199","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243078-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243079-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-40724","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-40724","tags":["report"]},{"url":"https://github.com/assimp/assimp/commit/ddb74c2bbdee1565dda667e85f0c82a0588c8053","tags":["report"]},{"url":"https://bugzilla.suse.com/1218474","tags":["report"]},{"url":"https://bugzilla.suse.com/1228142","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-40724","description":"Heap-based buffer overflow vulnerability in Assimp versions prior to 5.4.2 allows a local attacker to execute arbitrary code by inputting a specially crafted file into the product.","status":"published","published":"2024-07-19T07:38:28.057Z","modified":"2025-03-25T13:27:33.147Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:34:06.811965Z"}],"euvd":[{"id":"EUVD-2024-38589","description":"Heap-based buffer overflow vulnerability in Assimp versions prior to 5.4.2 allows a local attacker to execute arbitrary code by inputting a specially crafted file into the product.","status":"published","published":"2024-07-19T07:38:28Z","modified":"2025-03-25T13:27:33Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:53.630669Z"}],"ghsa":[{"id":"GHSA-rvvf-rc7q-23qm","title":"Heap-based buffer overflow vulnerability in Assimp versions prior to 5.4.2 allows a local...","description":"Heap-based buffer overflow vulnerability in Assimp versions prior to 5.4.2 allows a local attacker to execute arbitrary code by inputting a specially crafted file into the product.","status":"published","published":"2024-07-19T09:32:05Z","modified":"2025-03-25T15:32:21Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-120","CWE-787"],"updated_at":"2026-11-02T15:00:26.443231Z"}],"nvd":[{"id":"CVE-2024-40724","description":"Heap-based buffer overflow vulnerability in Assimp versions prior to 5.4.2 allows a local attacker to execute arbitrary code by inputting a specially crafted file into the product.","status":"published","published":"2024-07-19T08:15:02.07Z","modified":"2026-06-17T07:46:24.727Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-787","CWE-120"],"updated_at":"2026-11-02T14:10:13.413515Z"}],"osv":[{"id":"ALPINE-CVE-2024-40724","description":"Heap-based buffer overflow vulnerability in Assimp versions prior to 5.4.2 allows a local attacker to execute arbitrary code by inputting a specially crafted file into the product.","status":"published","published":"2024-07-19T08:15:02.07Z","modified":"2026-11-03T06:32:08.614704734Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:18:15.355745Z"},{"id":"CVE-2024-40724","description":"Heap-based buffer overflow vulnerability in Assimp versions prior to 5.4.2 allows a local attacker to execute arbitrary code by inputting a specially crafted file into the product.","status":"published","published":"2024-07-19T07:38:28.057Z","modified":"2026-10-28T10:41:58.507124202Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:41.618074Z"},{"id":"DEBIAN-CVE-2024-40724","description":"Heap-based buffer overflow vulnerability in Assimp versions prior to 5.4.2 allows a local attacker to execute arbitrary code by inputting a specially crafted file into the product.","status":"published","published":"2024-07-19T08:15:02.07Z","modified":"2026-11-02T12:02:37.995385883Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:43.156294Z"},{"id":"JLSEC-2026-187","description":"Heap-based buffer overflow vulnerability in Assimp versions prior to 5.4.2 allows a local attacker to execute arbitrary code by inputting a specially crafted file into the product.","status":"published","published":"2026-04-27T13:14:20.203Z","modified":"2026-07-18T00:00:28.177526447Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"OESA-2024-1910","title":"assimp security update","description":"Assimp is a library to load and process geometric scenes from various data formats. Assimp aims to provide a full asset conversion pipeline for use in game engines and real-time rendering systems of any kind, but is not limited to this purpose.\r\n\r\nSecurity Fix(es):\r\n\r\nHeap-based buffer overflow vulnerability in Assimp versions prior to 5.4.2 allows a local attacker to execute arbitrary code by inputting a specially crafted file into the product.(CVE-2024-40724)","status":"published","published":"2024-07-26T11:07:22Z","modified":"2026-08-18T01:18:31.363480573Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-1911","title":"assimp security update","description":"Assimp is a library to load and process geometric scenes from various data formats. Assimp aims to provide a full asset conversion pipeline for use in game engines and real-time rendering systems of any kind, but is not limited to this purpose.\r\n\r\nSecurity Fix(es):\r\n\r\nHeap-based buffer overflow vulnerability in Assimp versions prior to 5.4.2 allows a local attacker to execute arbitrary code by inputting a specially crafted file into the product.(CVE-2024-40724)","status":"published","published":"2024-07-26T11:07:22Z","modified":"2026-08-18T01:18:31.324626056Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-1912","title":"assimp security update","description":"Assimp is a library to load and process geometric scenes from various data formats. Assimp aims to provide a full asset conversion pipeline for use in game engines and real-time rendering systems of any kind, but is not limited to this purpose.\r\n\r\nSecurity Fix(es):\r\n\r\nHeap-based buffer overflow vulnerability in Assimp versions prior to 5.4.2 allows a local attacker to execute arbitrary code by inputting a specially crafted file into the product.(CVE-2024-40724)","status":"published","published":"2024-07-26T11:07:22Z","modified":"2026-08-18T01:18:31.346500596Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-1913","title":"assimp security update","description":"Assimp is a library to load and process geometric scenes from various data formats. Assimp aims to provide a full asset conversion pipeline for use in game engines and real-time rendering systems of any kind, but is not limited to this purpose.\r\n\r\nSecurity Fix(es):\r\n\r\nHeap-based buffer overflow vulnerability in Assimp versions prior to 5.4.2 allows a local attacker to execute arbitrary code by inputting a specially crafted file into the product.(CVE-2024-40724)","status":"published","published":"2024-07-26T11:07:22Z","modified":"2026-08-18T01:18:31.35626613Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"UBUNTU-CVE-2024-40724","description":"Heap-based buffer overflow vulnerability in Assimp versions prior to 5.4.2 allows a local attacker to execute arbitrary code by inputting a specially crafted file into the product.","status":"published","published":"2024-07-19T08:15:00Z","modified":"2026-04-22T14:59:19.011865Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:54.69008Z"},{"id":"MGASA-2024-0300","title":"Updated assimp packages fix security vulnerability","description":"Heap-based buffer overflow vulnerability in Assimp allows a local\nattacker to execute arbitrary code by inputting a specially crafted file\ninto the program.\n","status":"published","published":"2024-09-13T17:15:41Z","modified":"2026-04-16T04:44:36.259254284Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:0225-1","title":"Security update for assimp","description":"This update for assimp fixes the following issues:\n\n- CVE-2024-40724: Fixed heap-based buffer overflow in the PLY importer class (boo#1228142), \n","status":"published","published":"2024-07-27T04:01:30Z","modified":"2025-05-07T18:16:10.505067Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:14329-1","title":"assimp-devel-5.4.3-1.1 on GA media","description":"These are all security issues fixed in the assimp-devel-5.4.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-09-10T00:00:00Z","modified":"2026-02-04T02:13:06.241753Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"SUSE-SU-2024:2975-1","title":"Security update for libqt5-qt3d","description":"This update for libqt5-qt3d fixes the following issues:\n\n- CVE-2024-40724: Fixed heap-based buffer overflow in the PLY importer class in assimp (bsc#1228204)\n\nOther fixes:\n- Check for a nullptr returned from the shader manager\n- Fill image with transparency by default to avoid having junk if it's not filled properly before the first paint call\n- Fix QTextureAtlas parenting that could lead to crashes due to being used after free'd.\n","status":"published","published":"2024-08-20T07:17:52Z","modified":"2026-02-04T02:17:33.505129Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:2976-1","title":"Security update for libqt5-qt3d","description":"This update for libqt5-qt3d fixes the following issues:\n\n- CVE-2024-40724: Fixed heap-based buffer overflow in the PLY importer class in assimp (bsc#1228204)\n\nOther fixes:\n- Check for a nullptr returned from the shader manager\n- Fill image with transparency by default to avoid having junk if it's not filled properly before the first paint call\n- Fix QTextureAtlas parenting that could lead to crashes due to being used after free'd.\n","status":"published","published":"2024-08-20T07:18:16Z","modified":"2025-05-02T04:36:56.598998Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:2984-1","title":"Security update for libqt5-qt3d","description":"This update for libqt5-qt3d fixes the following issues:\n\n- CVE-2024-40724: Fixed a heap-based buffer overflow in the PLY importer class (bsc#1228204)\n- Checked for a nullptr returned from the shader manager\n- Fill image with transparency by default to avoid having junk if it's not filled properly before the first paint call\n- Fixed QTextureAtlas parenting that could lead to crashes due to being used after free'd\n","status":"published","published":"2024-08-20T09:10:46Z","modified":"2026-02-04T02:23:44.553224Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:2985-1","title":"Security update for libqt5-qtquick3d","description":"This update for libqt5-qtquick3d fixes the following issues:\n\n- CVE-2024-40724: Fixed a heap-based buffer overflow in the PLY importer class (bsc#1228199)\n- Fixed progressive anti-aliasing, which doesn't work if any object in the scene used a  PrincipledMaterial\n- Fixed a crash when a custom material/effect shader variable changes\n- Skipped processing unknown uniforms, as those that are vendor specific\n","status":"published","published":"2024-08-20T09:11:14Z","modified":"2026-02-04T03:43:35.22549Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:3078-1","title":"Security update for libqt5-qtquick3d","description":"This update for libqt5-qtquick3d fixes the following issues:\n\n- CVE-2024-40724: Fixed heap-based buffer overflow in the PLY importer class in assimp (bsc#1228199)\n\nOther fixes:\n- Fix progressive anti-aliasing, which doesn't work if any object in the scene used a PrincipledMaterial\n- Skip processing unknown uniforms, such as those that are vendor specific:\n","status":"published","published":"2024-09-02T14:43:00Z","modified":"2026-02-04T04:27:43.96939Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:3079-1","title":"Security update for libqt5-qt3d","description":"This update for libqt5-qt3d fixes the following issues:\n\n- CVE-2024-40724: Fixed heap-based buffer overflow in the PLY importer class in assimp (bsc#1228204)\n\nOther fixes:\n- Check for a nullptr returned from the shader manager\n- Fill image with transparency by default to avoid having junk if it's not filled properly before the first paint call\n- Fix QTextureAtlas parenting that could lead to crashes due to being used after free'd.\n","status":"published","published":"2024-09-02T14:43:20Z","modified":"2026-02-04T03:03:59.082972Z","updated_at":"2026-11-02T15:53:55.136363Z"}]}}