PT-2025-12420 · Assimp+2 · Assimp+2

D3Ng03 · Published 2025-03-21 · Updated 2026-02-13 · CVE-2025-2592

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Open Asset Import Library Assimp version 5.4.3

Description A critical vulnerability has been found in Open Asset Import Library Assimp. This issue affects the function CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Recommendations To fix this issue, apply the patch named 2690e354da0c681db000cfd892a55226788f2743. As a temporary workaround, consider disabling the CSMImporter::InternReadFile function until a patch is available. Restrict access to the vulnerable file code/AssetLib/CSM/CSMLoader.cpp to minimize the risk of exploitation.

Exploit

Fix

DoS

Divide By Zero

Buffer Overflow

Heap Based Buffer Overflow

Weakness Enumeration

CWE-369

CWE-119

CWE-122

Related Identifiers

BDU:2025-12577

BDU:2025-12578

BDU:2025-12581

CVE-2025-2592

OPENSUSE-SU-2025:0113-1

OPENSUSE-SU-2025:0117-1

OPENSUSE-SU-2025:14950-1

OPENSUSE-SU-2026:20781-1

SUSE-SU-2026:21821-1

Affected Products

Assimp

Debian

Red Os

References · 58

• 🔥 https://github.com/assimp/assimp/issues/6010 · Exploit
• 🔥 https://github.com/assimp/assimp/issues/6010#issue-2877368110 · Exploit
• https://github.com/assimp/assimp/pull/6052 · Patch
• https://github.com/assimp/assimp/commit/2690e354da0c681db000cfd892a55226788f2743 · Patch
• https://osv.dev/vulnerability/CVE-2025-2592 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:0117-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2592 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:0113-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-12581 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-2592 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:14950-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-12578 · Security Note
• https://ubuntu.com/security/CVE-2025-2592 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-2592 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-2592 · Vendor Advisory