CVE-2024-45679

What it actually does

Heap-based buffer overflow in the Assimp library parser allows arbitrary code execution when a specially crafted input file is imported.

Why it matters to the business

Attackers with local access can gain code execution on systems that process untrusted 3D model files, risking full system compromise in media, gaming, or CAD workflows; the issue affects a widely used open-source library with many downstream dependents.

How an attack unfolds

An attacker prepares a malicious file that triggers the heap overflow during parsing, then causes a local process using Assimp to import the file, resulting in arbitrary code execution.

How to fix it

Update assimp/assimp to the commit c35200e38ea8f058812b83de2ef32c6093b0ece2 or later; rebuild and redeploy any applications that statically or dynamically link the library.

How to confirm the fix worked

Confirm the installed Assimp version or commit hash is at or beyond c35200e38ea8f058812b83de2ef32c6093b0ece2; test file import functionality with known-good and boundary-case inputs to verify no regression.

Typical attack path

1. Craft a malicious file that exploits the buffer overflow condition in the Assimp importer
2. Place the file in a location accessible to the target process or user
3. Trigger import of the file through an application or script that uses the vulnerable Assimp library
4. Achieve arbitrary code execution in the context of the importing process

How to detect it

Review application logs for unexpected crashes or errors during file import operations; inspect process memory dumps or core files for signs of heap corruption around Assimp parsing routines.

What your security team should do

• Immediately inventory all builds and containers that include Assimp and schedule upgrades to the fixed commit
• Apply compensating controls such as file-type allowlisting and sandboxing for model import workflows until patched
• Monitor EPSS and exploit maturity indicators for any increase in risk