Bug: Issue 483501004: assimp:assimp_fuzzer_glb: Heap-buffer-overflow in Assimp::glTF2Importer::ImportNode

https://issues.oss-fuzz.com/issues/483501004

Reference Info: 483501004 assimp:assimp_fuzzer_glb: Heap-buffer-overflow in Assimp::glTF2Importer::ImportNode
component: [Public Trackers > 1362134 > OSS Fuzz](https://issues.oss-fuzz.com/components/1638179)
status: New
reporter: [87...@developer.gserviceaccount.com](mailto:87...@developer.gserviceaccount.com)
cc: [ki...@assimp.org](mailto:ki...@assimp.org), [kim.kulling@googlemail.com](mailto:kim.kulling@googlemail.com), [re...@fastmail.com](mailto:re...@fastmail.com)
collaborators: [co...@oss-fuzz.com](mailto:co...@oss-fuzz.com)
type: Vulnerability
access level: Limited visibility
priority: P2
severity: S2
hotlist: [Reproducible](https://issues.oss-fuzz.com/hotlists/6182481), [Stability-Memory-AddressSanitizer](https://issues.oss-fuzz.com/hotlists/6182447)
retention: Component default
Project: assimp
Reported: Feb 11, 2026

[87...@developer.gserviceaccount.com](mailto:87...@developer.gserviceaccount.com) added [comment #1](https://issues.oss-fuzz.com/issues/483501004#comment1):
Detailed Report: [https://oss-fuzz.com/testcase?key=6480755831406592](https://www.google.com/url?q=https://oss-fuzz.com/testcase?key%3D6480755831406592&sa=D&source=buganizer&usg=AOvVaw1WqMHDS0DopXpe3E2yvwfp)

Project: assimp
Fuzzing Engine: afl
Fuzz Target: assimp_fuzzer_glb
Job Type: afl_asan_assimp
Platform Id: linux

Crash Type: Heap-buffer-overflow READ 8
Crash Address: 0x7b60fbbe1740
Crash State:
Assimp::glTF2Importer::ImportNode
Assimp::glTF2Importer::ImportNode
Assimp::glTF2Importer::ImportNodes

Sanitizer: address (ASAN)

Recommended Security Severity: Medium

Regressed: [https://oss-fuzz.com/revisions?job=afl_asan_assimp&range=202601210716:202601220724](https://www.google.com/url?q=https://oss-fuzz.com/revisions?job%3Dafl_asan_assimp%26range%3D202601210716:202601220724&sa=D&source=buganizer&usg=AOvVaw3Z60nV8q99Ml7BsgdN2Enh)

Reproducer Testcase: [https://oss-fuzz.com/download?testcase_id=6480755831406592](https://www.google.com/url?q=https://oss-fuzz.com/download?testcase_id%3D6480755831406592&sa=D&source=buganizer&usg=AOvVaw2C_mJj-6GHVg-NwGpj6EOm)

Issue filed automatically.

See [https://google.github.io/oss-fuzz/advanced-topics/reproducing](https://www.google.com/url?q=https://google.github.io/oss-fuzz/advanced-topics/reproducing&sa=D&source=buganizer&usg=AOvVaw2PF-rd9_FrkFJ-mNErDWkF) for instructions to reproduce this bug locally.
When you fix this bug, please
* mention the fix revision(s).
* state whether the bug was a short-lived regression or an old bug in any stable releases.
* add any other useful information.
This information can help downstream consumers.

If you need to contact the OSS-Fuzz team with a question, concern, or any other feedback, please file an issue at [https://github.com/google/oss-fuzz/issues](https://www.google.com/url?q=https://github.com/google/oss-fuzz/issues&sa=D&source=buganizer&usg=AOvVaw3uDxRzHL584JLrGWXGLu6V). Comments on individual Monorail issues are not monitored.

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without an upstream patch, then the bug report will automatically
become visible to the public.

Generated by Google IssueTracker notification system.

Start with the OSS-Fuzz reproducer testcase 6480755831406592 and the documented local reproduction instructions. Trace the ASAN report through Assimp::glTF2Importer::ImportNodes and ImportNode, then verify the fix against the same glb input. Done means the testcase no longer produces the reported heap-buffer-overflow under the assimp_fuzzer_glb ASAN job.

Written by the indexing model from the issue text.