Silk.NET.Assimp.Native bundles pre-fix assimp 6.0.2 (Q3D enabled) — Quick3D heap overflow CVE-2025-11277
Open
- Dominant language
- C#
- Stars
- 5.2k
- Forks
- 477
- Avg merge
- 3d 16h
- Merged PRs (30d)
- 2
Description
The Assimp submodule (build/submodules/Assimp) is pinned at fb375dd8 = assimp v6.0.2, 101 commits before the v6.0.3 fix for CVE-2025-11277: a 32-bit overflow in Q3DImporter::InternReadFile (Q3DLoader.cpp) undersizes an allocation and the write loop overflows the heap.
The native build does not set ASSIMP_BUILD_NO_Q3D_IMPORTER, so a .NET app importing a crafted Quick3D file (.q3o/.q3s) via Assimp.ImportFile() -> aiImportFile reaches it.
Fix: bump the submodule to v6.0.3+ (which contains PR#6370 and PR#6417, the Q3DLoader overflow checks), rebuild Silk.NET.Assimp.Native, and publish an updated package.
Contributor guide
Assessment
This issue has not been assessed yet.