Log in Start free

Vulnerability · Published Apr 3, 2025 · Assigned by VulDB

CVE-2025-3160Open Asset Import Library Assimp File SceneCombiner.cpp AddNodeHashes out-of-bounds

Low 3.3

In plain English

A low-severity out-of-bounds read in Assimp from Open Asset Import Library. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.3%top 79.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::SceneCombiner::AddNodeHashes of the file code/Common/SceneCombiner.cpp of the component File Handler. The manipulation leads to out-of-bounds read. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as a0993658f40d8e13ff5823990c30b43c82a5daf0. It is recommended to apply a patch to fix this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12assimpno fix listedDEBIAN-CVE-2025-3160
Debian:13assimpno fix listedDEBIAN-CVE-2025-3160
Debian:14assimp6.0.2+ds-1DEBIAN-CVE-2025-3160
PyPIpyassimpno fix listedPYSEC-2025-264
Ubuntu:22.04:LTSassimpno fix listedUBUNTU-CVE-2025-3160
Ubuntu:24.04:LTSassimpno fix listedUBUNTU-CVE-2025-3160
Ubuntu:25.10assimpno fix listedUBUNTU-CVE-2025-3160
Ubuntu:26.04:LTSassimpno fix listedUBUNTU-CVE-2025-3160
Ubuntu:26.10assimpno fix listedUBUNTU-CVE-2025-3160

Affected products (as reported)

VendorProductVersions
Open Asset Import Library Assimp 5.4.3

Weakness: CWE-125, CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References