openSUSE-SU-2026:21242-1

Import Source

JSON Data

https://api.test.osv.dev/v1/vulns/openSUSE-SU-2026:21242-1

Upstream

CVE (5)

Related

CVE (5)

Published

2026-07-06T14:23:04Z

Modified

2026-07-09T18:24:30Z

Summary

Security update for assimp

Details

This update for assimp fixes the following issues

CVE-2025-11277: large mWidth and mHeight dimensions can lead to integer overflow and a heap-based buffer overflow (bsc#1251019).
CVE-2026-10197: NULL pointer dereference in ImportEmbeddedTextures when mimeType lacks '/' (bsc#1266996).
CVE-2026-10199: NULL pointer dereference in glTF2::LazyDict::operator[] due to unchecked node access in ImportAnimations (bsc#1266998).
CVE-2026-10200: [glTF] Heap-buffer-overflow in CopyValue() when parsing invalid 4x4 matrix with insufficient data (bsc#1266999).
CVE-2026-10232: heap use-after-free in aiNode::~aiNode due to invalid node tree when processing malformed ASE files (bsc#1267037).

References

Affected packages

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

5.4.3-160000.4.1

{
    "binaries": [
        {
            "assimp-devel": "5.4.3-160000.4.1",
            "libassimp5": "5.4.3-160000.4.1"
        }
    ]
}

source

"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21242-1.json"