Skip to content
OpenAdvisories
High · 8.4 CVE-2024-40724 EUVD-2024-38589GHSA-rvvf-rc7q-23qm

Heap-based buffer overflow vulnerability in Assimp versions prior to 5.4.2 allows a local attacker to execute arbitrary code by inputting a…

Published Jul 19, 2024 · Updated Mar 25, 2025 · Assigned by jpcert

Vendor: Open Asset Import Library Product: Assimp Package: assimp Package: assimp Package: assimp Ecosystem: Alpine Ecosystem: Debian Ecosystem: Ubuntu

Description

Heap-based buffer overflow vulnerability in Assimp versions prior to 5.4.2 allows a local attacker to execute arbitrary code by inputting a specially crafted file into the product.

Affected products

VendorProductAffectedFixed
Open Asset Import Library Assimp prior to 5.4.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 assimp 5.4.2+ds-1 —
Debian 13 assimp 5.4.2+ds-1 —
Debian 12 assimp No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS assimp No fix yet —
Ubuntu 22.04 LTS assimp No fix yet —
Ubuntu 20.04 LTS assimp No fix yet —
Ubuntu 18.04 LTS assimp No fix yet —
Ubuntu 16.04 LTS assimp No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP6 libqt5-qt3d 5.15.12+kde0-150600.3.3.1 SUSE-SU-2024:2984-1
SLES 15 SP6 libqt5-qtquick3d 5.15.12+kde1-150600.3.3.1 SUSE-SU-2024:2985-1
SLES 15 SP5 libqt5-qt3d 5.15.8+kde0-150500.3.3.1 SUSE-SU-2024:3079-1
SLES 15 SP5 libqt5-qtquick3d 5.15.8+kde1-150500.3.3.1 SUSE-SU-2024:3078-1
SLES 15 SP4 libqt5-qt3d 5.15.2+kde39-150400.3.3.1 SUSE-SU-2024:2976-1
SLES 15 SP3 libqt5-qt3d 5.12.7-150200.4.3.1 SUSE-SU-2024:2975-1
SLES 15 SP2 libqt5-qt3d 5.12.7-150200.4.3.1 SUSE-SU-2024:2975-1
Show 9 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP4 libqt5-qt3d 5.15.2+kde39-150400.3.3.1 SUSE-SU-2024:2976-1
SLES for SAP 15 SP3 libqt5-qt3d 5.12.7-150200.4.3.1 SUSE-SU-2024:2975-1
SLES for SAP 15 SP2 libqt5-qt3d 5.12.7-150200.4.3.1 SUSE-SU-2024:2975-1
SLE HPC 15 SP4 libqt5-qt3d 5.15.2+kde39-150400.3.3.1 SUSE-SU-2024:2976-1
SLE HPC 15 SP3 libqt5-qt3d 5.12.7-150200.4.3.1 SUSE-SU-2024:2975-1
SLE HPC 15 SP2 libqt5-qt3d 5.12.7-150200.4.3.1 SUSE-SU-2024:2975-1
SUSE Package Hub 15 SP6 assimp 5.3.1-bp156.3.3.1 openSUSE-SU-2024:0225-1
SUSE Package Hub 15 SP5 assimp 5.3.1-bp156.3.3.1 openSUSE-SU-2024:0225-1
SUSE Enterprise Storage 7.1 libqt5-qt3d 5.12.7-150200.4.3.1 SUSE-SU-2024:2975-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed assimp 5.4.3-1.1 openSUSE-SU-2024:14329-1
openSUSE Leap 15.6 assimp 5.3.1-bp156.3.3.1 openSUSE-SU-2024:0225-1
openSUSE Leap 15.6 libqt5-qt3d 5.15.12+kde0-150600.3.3.1 SUSE-SU-2024:2984-1
openSUSE Leap 15.6 libqt5-qtquick3d 5.15.12+kde1-150600.3.3.1 SUSE-SU-2024:2985-1
openSUSE Leap 15.5 assimp 5.3.1-bp156.3.3.1 openSUSE-SU-2024:0225-1
openSUSE Leap 15.5 libqt5-qt3d 5.15.8+kde0-150500.3.3.1 SUSE-SU-2024:3079-1
openSUSE Leap 15.5 libqt5-qtquick3d 5.15.8+kde1-150500.3.3.1 SUSE-SU-2024:3078-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 assimp 5.4.3-r0 —
Alpine v3.23 assimp 5.4.3-r0 —
Alpine v3.22 assimp 5.4.3-r0 —
Alpine v3.21 assimp 5.4.3-r0 —
Alpine v3.20 assimp 5.4.3-r0 —

Advisories 8

References