CVE-2024-48425 Null dereference in n/a

Medium 5.5 Published 24 Oct 2024 Updated 28 Oct 2024

A null pointer dereference in the Assimp library allows attackers to cause a denial of service via crafted 3D model files.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2024-48425?

CVE-2024-48425 is a medium-severity vulnerability in n/a, published on 24 Oct 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode function within the Assimp library during fuzz testing using AddressSanitizer. The crash occurs due to a read access violation at address 0x000000000460, which points to the zero page, indicating a null or invalid pointer dereference.

Weakness: CWE-120

Which versions are affected by CVE-2024-48425?

1 open source package ship an affected version, including pyassimp. It affects 1 product.

Package	Affected	Fixed in
`pyassimp` PyPI	All versions to `5.4.3`	None

Products include Assimp Assimp.

How do I fix CVE-2024-48425?

Upgrade to a fixed version.

Is CVE-2024-48425 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-48425 exists.

Sources

Also known as DEBIAN-CVE-2024-48425, GHSA-5qr5-9jfv-96j2, OESA-2024-2360, PYSEC-2024-293, UBUNTU-CVE-2024-48425.