Bug: Issue 486340728: assimp:assimp_fuzzer: Use-of-uninitialized-value in Assimp::AMFImporter::Postprocess_BuildMeshSet

https://issues.oss-fuzz.com/issues/486340728

Reference Info: 486340728 assimp:assimp_fuzzer: Use-of-uninitialized-value in Assimp::AMFImporter::Postprocess_BuildMeshSet
component: [Public Trackers > 1362134 > OSS Fuzz](https://issues.oss-fuzz.com/components/1638179)
status: New
reporter: [87...@developer.gserviceaccount.com](mailto:87...@developer.gserviceaccount.com)
cc: [ki...@assimp.org](mailto:ki...@assimp.org), [kim.kulling@googlemail.com](mailto:kim.kulling@googlemail.com), [re...@fastmail.com](mailto:re...@fastmail.com)
collaborators: [co...@oss-fuzz.com](mailto:co...@oss-fuzz.com)
type: Vulnerability
access level: Limited visibility
priority: P2
severity: S2
hotlist: [Reproducible](https://issues.oss-fuzz.com/hotlists/6182481), [Stability-Memory-MemorySanitizer](https://issues.oss-fuzz.com/hotlists/6182183)
retention: Component default
Project: assimp
Reported: Feb 21, 2026

[87...@developer.gserviceaccount.com](mailto:87...@developer.gserviceaccount.com) added [comment #1](https://issues.oss-fuzz.com/issues/486340728#comment1):
Detailed Report: [https://oss-fuzz.com/testcase?key=5236639130779648](https://www.google.com/url?q=https://oss-fuzz.com/testcase?key%3D5236639130779648&sa=D&source=buganizer&usg=AOvVaw01YEEk5OuIGtMbIdZCNjW8)

Project: assimp
Fuzzing Engine: libFuzzer
Fuzz Target: assimp_fuzzer
Job Type: libfuzzer_msan_assimp
Platform Id: linux

Crash Type: Use-of-uninitialized-value
Crash Address:
Crash State:
Assimp::AMFImporter::Postprocess_BuildMeshSet
Assimp::AMFImporter::Postprocess_BuildNodeAndObject
Assimp::AMFImporter::Postprocess_BuildScene

Sanitizer: memory (MSAN)

Recommended Security Severity: Medium

Regressed: [https://oss-fuzz.com/revisions?job=libfuzzer_msan_assimp&range=202104020622:202104030622](https://www.google.com/url?q=https://oss-fuzz.com/revisions?job%3Dlibfuzzer_msan_assimp%26range%3D202104020622:202104030622&sa=D&source=buganizer&usg=AOvVaw32OTNM-wAk_7ttNmA_rlLn)

Reproducer Testcase: [https://oss-fuzz.com/download?testcase_id=5236639130779648](https://www.google.com/url?q=https://oss-fuzz.com/download?testcase_id%3D5236639130779648&sa=D&source=buganizer&usg=AOvVaw0X4RSL35kfuS3wqxXEcxGN)

Issue filed automatically.

See [https://google.github.io/oss-fuzz/advanced-topics/reproducing](https://www.google.com/url?q=https://google.github.io/oss-fuzz/advanced-topics/reproducing&sa=D&source=buganizer&usg=AOvVaw2PF-rd9_FrkFJ-mNErDWkF) for instructions to reproduce this bug locally.
When you fix this bug, please
* mention the fix revision(s).
* state whether the bug was a short-lived regression or an old bug in any stable releases.
* add any other useful information.
This information can help downstream consumers.

If you need to contact the OSS-Fuzz team with a question, concern, or any other feedback, please file an issue at [https://github.com/google/oss-fuzz/issues](https://www.google.com/url?q=https://github.com/google/oss-fuzz/issues&sa=D&source=buganizer&usg=AOvVaw3uDxRzHL584JLrGWXGLu6V). Comments on individual Monorail issues are not monitored.

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without an upstream patch, then the bug report will automatically
become visible to the public.

Generated by Google IssueTracker notification system.

Start with the Assimp::AMFImporter::Postprocess_BuildMeshSet stack shown in the report and download testcase 5236639130779648. Follow the OSS-Fuzz reproducing instructions with the assimp_fuzzer MSAN job, then trace the uninitialized value through Postprocess_BuildNodeAndObject and Postprocess_BuildScene. Done means the reproducer no longer reports a MemorySanitizer error and the regression status is documented.

Written by the indexing model from the issue text.