PT-2024-33103 · Assimp+2 · Assimp+2

Cla7Aye15I4Ndo · Published 2024-10-24 · Updated 2025-06-16 · CVE-2024-48423

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions assimp version 5.4.3

Description An issue in the Assimp library allows a local attacker to execute arbitrary code via the CallbackToLogRedirector function. This enables the attacker to potentially gain control over the system.

Recommendations For assimp version 5.4.3, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider disabling the CallbackToLogRedirector function until a patch is available.

Exploit

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2025-07005

CVE-2024-48423

OESA-2025-1602

OESA-2025-1603

OPENSUSE-SU-2024:14610-1

OPENSUSE-SU-2025:0113-1

PYSEC-2024-120

Affected Products

Debian

Red Os

Assimp

References · 43

• 🔥 https://github.com/assimp/assimp/issues/5788 · Exploit
• https://bdu.fstec.ru/vul/2025-07005 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-48423 · Security Note
• https://osv.dev/vulnerability/OESA-2025-1603 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14610-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1602 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-48423 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-48423 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-48423 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-48423 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-48423 · Security Note
• https://osv.dev/vulnerability/PYSEC-2024-120 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-48423 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:0113-1 · Vendor Advisory
• https://github.com/assimp/assimp/releases/tag/v6.0.0 · Note