CVE-2024-48425

What it actually does

Null pointer dereference in Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode triggers a segmentation fault on invalid memory read.

Why it matters to the business

Applications using the affected library may crash when processing certain 3D model files, causing service disruption; the listed SUSE packages require patching before the CISA-style deadlines if applicable.

How an attack unfolds

An attacker supplies a crafted 3D asset that reaches the large-mesh splitting routine, dereferencing a null pointer and crashing the process; no public exploits or threat actors are known.

How to fix it

Upgrade tomcat to 8.0.53-29.54.1 and javapackages-tools to 5.3.1-14.7.3 on the listed SUSE releases; rebuild or redeploy any dependent applications after the library update.

How to confirm the fix worked

Confirm package versions match the fixed releases, then re-run the original fuzzing or regression test suite against the updated library to verify absence of the segmentation fault.

Typical attack path

1. Identify a target application that links against the vulnerable Assimp library
2. Craft or obtain a malicious 3D model file that exercises the SplitLargeMeshesProcess_Triangle path
3. Cause the application to load the file (e.g., via upload, import, or automated processing)
4. Trigger the null dereference resulting in a crash

How to detect it

Review application and system logs for segmentation fault entries referencing Assimp or SplitLargeMeshesProcess_Triangle; correlate with file-processing events involving 3D model formats.

What your security team should do

• Apply the listed fixed package versions immediately on SUSE SLES 12 SP3 systems
• Scan build pipelines and container images for the vulnerable Assimp dependency
• Prioritize remediation on any internet-facing or high-availability services that process untrusted 3D assets