PT-2025-40787 · Assimp+5 · Assimp+5

Sand · Published 2025-10-04 · Updated 2026-02-24 · CVE-2025-11277

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Open Asset Import Library Assimp version 6.0.2

Description A flaw exists in Open Asset Import Library Assimp 6.0.2 within the Q3DImporter::InternReadFile function located in the assimp/code/AssetLib/Q3D/Q3DLoader.cpp file. This can lead to a heap-based buffer overflow. The issue is exploitable locally, and details about the exploit are publicly available.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Buffer Overflow

Heap Based Buffer Overflow

Weakness Enumeration

CWE-119

CWE-122

Related Identifiers

ALSA-2025:20963

ALSA-2025:22361

BDU:2025-15598

CVE-2025-11277

INFSA-2025_19911

INFSA-2025_20963

OESA-2026-1079

OESA-2026-1080

OESA-2026-1081

OESA-2026-1082

OESA-2026-1083

OESA-2026-1084

PYSEC-2025-157

RHSA-2025:19911

RHSA-2025:20963

RHSA-2025:22361

RHSA-2025:22413

RHSA-2025:22414

RHSA-2025:22549

RHSA-2025:22663

RHSA-2025_19911

RHSA-2025_20963

Affected Products

Almalinux

Assimp

Debian

Red Hat

Red Os

Rocky Linux

References · 49

• 🔥 https://github.com/assimp/assimp/issues/6358 · Exploit
• 🔥❌ https://github.com/user-attachments/files/22422643/poc.zip · Exploit, Deleted
• https://errata.rockylinux.org/RLSA-2025:20963 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2025:22361 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2025-19911.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-11277 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-11277 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2025:19911 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1080 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-11277 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11277 · Security Note
• https://errata.almalinux.org/10/ALSA-2025-22361.html · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2025-20963.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-11277 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-15598 · Security Note