PT-2025-12419 · Assimp+2 · Assimp+2
D3Ng03
·
Published
2025-03-21
·
Updated
2026-01-16
·
CVE-2025-2591
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Open Asset Import Library Assimp version 5.4.3
Description
A vulnerability was found in the Open Asset Import Library Assimp. This issue affects the function
MDLImporter::InternReadFile Quake1 of the file code/AssetLib/MDL/MDLLoader.cpp. The manipulation of the arguments skinwidth and skinheight leads to a divide by zero error. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.Recommendations
To fix this issue, apply the patch identified as
ab66a1674fcfac87aaba4c8b900b315ebc3e7dbd. As a temporary workaround, consider restricting the use of the MDLImporter::InternReadFile Quake1 function until a patch is available. Avoid manipulating the skinwidth and skinheight arguments in the affected function to minimize the risk of exploitation.Exploit
Fix
DoS
Improper Resource Release
Divide By Zero
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Assimp
Debian
Red Os