PT-2025-22930 · Assimp+2 · Assimp+2
Clesmian
·
Published
2025-05-26
·
Updated
2026-04-25
·
CVE-2025-5200
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Open Asset Import Library Assimp version 5.4.3
Description
A problem was found in the function
MDLImporter::InternReadFile Quake1 of the file assimp/code/AssetLib/MDL/MDLLoader.cpp, which leads to out-of-bounds read. The attack can be launched on the local host. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.Recommendations
For Open Asset Import Library Assimp version 5.4.3, as a temporary workaround, consider disabling the
MDLImporter::InternReadFile Quake1 function until a patch is available.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Out of bounds Read
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Assimp
Debian