Open Asset Import Library Assimp Use-After-Free Vulnerability in BVHLoader Component

A critical use-after-free vulnerability has been identified in Open Asset Import Library (Assimp) versions prior to 5.4.3. The issue arises in the BVHLoader component, specifically within the ReadNodeChannels function. Here, the argument pNode is manipulated in a way that leads to memory being accessed after it has been freed. This vulnerability requires local exploitation.

Impact

Exploitation of this vulnerability causes a heap-use-after-free error, leading to undefined behavior and a program crash. However, such use-after-free vulnerabilities can often be exploited to execute arbitrary code.

Reproduction

The vulnerability can be reproduced by compiling Assimp with AddressSanitizer and Fuzzer enabled. After compiling, the Assimp fuzzer can be used to test a crafted BVH file that triggers the use-after-free condition in the ReadNodeChannels function.