PT-2025-22885 · Assimp+1 · Assimp+1

Clesmian · Published 2025-05-26 · Updated 2025-05-26 · CVE-2025-5169

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Open Asset Import Library Assimp version 5.4.3

Description A problematic vulnerability has been found in Open Asset Import Library Assimp, affecting the function MDLImporter::InternReadFile 3DGS MDL345 of the file assimp/code/AssetLib/MDL/MDLLoader.cpp. This leads to an out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public.

Recommendations For Open Asset Import Library Assimp version 5.4.3, consider disabling the MDLImporter::InternReadFile 3DGS MDL345 function until a patch is available to prevent out-of-bounds read. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Buffer Overflow

Weakness Enumeration

CWE-125

CWE-119

Related Identifiers

CVE-2025-5169

PYSEC-2025-176

Affected Products

Assimp

Debian

References · 18

• 🔥 https://github.com/assimp/assimp/issues/6171 · Exploit
• 🔥❌ https://github.com/user-attachments/files/20208891/reproducer.zip · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2025-5169 · Security Note
• https://osv.dev/vulnerability/CVE-2025-5169 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-5169 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-5169 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2025-176 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-5169 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-5169 · Security Note
• https://ubuntu.com/security/CVE-2025-5169 · Vendor Advisory
• https://github.com/assimp/assimp/issues/6128 · Note
• https://t.me/cvetracker/24619 · Telegram Post
• https://vuldb.com/?submit.578004 · Note
• https://t.me/cvenotify/123599 · Telegram Post
• https://vuldb.com/?id.310257 · Note