PT-2025-13833 · Assimp+2 · Assimp+2

D3Ng03 · Published 2025-03-31 · Updated 2026-02-15 · CVE-2025-3015

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Open Asset Import Library Assimp version 5.4.3

Description A critical issue has been found in the ASE File Handler component of the Open Asset Import Library Assimp. This issue affects the Assimp::ASEImporter::BuildUniqueRepresentation function in the file ASELoader.cpp. The manipulation of the mIndices argument leads to an out-of-bounds read. It is possible to initiate the attack remotely.

Recommendations For Open Asset Import Library Assimp version 5.4.3, upgrade to version 6.0 to address this issue. As a temporary workaround, consider restricting access to the ASELoader.cpp file or the Assimp::ASEImporter::BuildUniqueRepresentation function until the patch is applied. Apply the patch named 7c705fde418d68cca4e8eff56be01b2617b0d6fe to fix this issue.

Exploit

Fix

Buffer Overflow

Out of bounds Read

Weakness Enumeration

CWE-119

CWE-125

Related Identifiers

BDU:2025-12928

CVE-2025-3015

OESA-2025-1402

OESA-2025-1403

OESA-2025-1404

OESA-2025-1405

OPENSUSE-SU-2025:0113-1

OPENSUSE-SU-2025:14950-1

OPENSUSE-SU-2026:20781-1

SUSE-SU-2026:21821-1

Affected Products

Assimp

Debian

Red Os

References · 56

• 🔥 https://github.com/assimp/assimp/issues/6021#issue-2877378829 · Exploit
• 🔥 https://github.com/assimp/assimp/issues/6021 · Exploit
• https://github.com/assimp/assimp/commit/7c705fde418d68cca4e8eff56be01b2617b0d6fe · Patch
• https://github.com/assimp/assimp/pull/6045 · Patch
• https://osv.dev/vulnerability/OESA-2025-1405 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-3160 · Security Note
• https://osv.dev/vulnerability/OESA-2025-1404 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-3016 · Security Note
• https://bdu.fstec.ru/vul/2025-12928 · Security Note
• https://ubuntu.com/security/CVE-2025-3015 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-3015 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:0113-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1403 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-3015 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1402 · Vendor Advisory