PT-2025-14762 · Assimp+2 · Assimp+2

D3Ng03 · Published 2025-04-03 · Updated 2025-10-08 · CVE-2025-3160

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Open Asset Import Library Assimp version 5.4.3

Description A vulnerability has been found in the Open Asset Import Library Assimp, affecting the function Assimp::SceneCombiner::AddNodeHashes of the file code/Common/SceneCombiner.cpp of the component File Handler. The manipulation leads to out-of-bounds read. An attack has to be approached locally.

Recommendations Apply the patch identified as a0993658f40d8e13ff5823990c30b43c82a5daf0 to fix this issue. As a temporary workaround, consider disabling the Assimp::SceneCombiner::AddNodeHashes function until the patch is applied.

Exploit

Fix

Out of bounds Read

Buffer Overflow

Weakness Enumeration

CWE-125

CWE-119

Related Identifiers

BDU:2025-12926

CVE-2025-3160

OESA-2025-1402

OESA-2025-1403

OESA-2025-1404

OESA-2025-1405

OPENSUSE-SU-2025:15198-1

Affected Products

Assimp

Debian

Red Os

References · 42

• 🔥 https://github.com/assimp/assimp/issues/6025 · Exploit
• 🔥 https://github.com/assimp/assimp/issues/6025#issue-2877385383 · Exploit
• https://github.com/assimp/assimp/commit/a0993658f40d8e13ff5823990c30b43c82a5daf0 · Patch
• https://github.com/assimp/assimp/pull/6049 · Patch
• https://osv.dev/vulnerability/OESA-2025-1404 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-12926 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-3015 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-3160 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1405 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-3160 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-3016 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-3160 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-3159 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-3160 · Security Note
• https://osv.dev/vulnerability/OESA-2025-1402 · Vendor Advisory