dotnet / dotnet/Silk.NET

Silk.NET.Assimp.Native bundles pre-fix assimp 6.0.2 (Q3D enabled) — Quick3D heap overflow CVE-2025-11277

Open
#2,589 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
5.2k
Forks
477
Avg merge
3d 16h
Merged PRs (30d)
2

Description

The Assimp submodule (build/submodules/Assimp) is pinned at fb375dd8 = assimp v6.0.2, 101 commits before the v6.0.3 fix for CVE-2025-11277: a 32-bit overflow in Q3DImporter::InternReadFile (Q3DLoader.cpp) undersizes an allocation and the write loop overflows the heap.

The native build does not set ASSIMP_BUILD_NO_Q3D_IMPORTER, so a .NET app importing a crafted Quick3D file (.q3o/.q3s) via Assimp.ImportFile() -> aiImportFile reaches it.

Fix: bump the submodule to v6.0.3+ (which contains PR#6370 and PR#6417, the Q3DLoader overflow checks), rebuild Silk.NET.Assimp.Native, and publish an updated package.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.