PT-2024-31725 · Assimp+3 · Assimp+3

Yuhei Kawakoya · Published 2024-09-17 · Updated 2025-08-13 · CVE-2024-45679

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Assimp versions prior to 5.4.3

Description: A heap-based buffer overflow issue allows a local attacker to execute arbitrary code by importing a specially crafted file into the product. This can be achieved through the import functionality of the product.

Recommendations: For versions prior to 5.4.3, update to version 5.4.3 or later to resolve the issue. As a temporary workaround, consider restricting the import of files from untrusted sources until the update is applied.

Fix

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

ALT-PU-2025-10063

BDU:2025-02665

CVE-2024-45679

OESA-2024-2194

OESA-2024-2195

OESA-2024-2196

OESA-2024-2197

OPENSUSE-SU-2024:14342-1

Affected Products

Alt Linux

Assimp

Debian

Red Os

References · 28

• https://github.com/assimp/assimp/releases/tag/v5.4.3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-45679 · Security Note
• https://bdu.fstec.ru/vul/2025-02665 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-45679 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-2195 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-2196 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-45679 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-45679 · Security Note
• https://osv.dev/vulnerability/OESA-2024-2197 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14342-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-45679 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-45679 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-45679 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-2194 · Vendor Advisory
• https://redos.red-soft.ru/support/secure · Note