Open Asset Import Library Assimp Out-of-Bounds Read Vulnerability in MDL Importer

A vulnerability allowing out-of-bounds read has been identified in Open Asset Import Library (Assimp) version 5.4.3. This issue arises in the MDLImporter::ParseSkinLump_3DGS_MDL7 function within the MDLMaterialLoader.cpp file. The vulnerability requires local exploitation.

Impact

Exploitation of this vulnerability leads to a heap-based buffer overflow, which can commonly result in memory corruption and potentially allow for arbitrary code execution.

Reproduction

The vulnerability can be reproduced by building the Assimp fuzzer with AddressSanitizer enabled, which is similar to how OSS-Fuzz operates. After compiling the fuzzer, it can be run with a specific reproducer that triggers the out-of-bounds read by exploiting the MDL importer's skin lump parsing function.