Vulnerability · Published Oct 5, 2025 · Assigned by VulDB
CVE-2025-11277Open Asset Import Library Assimp Q3DLoader.cpp InternReadFile heap-based overflow
Medium 5.3
In plain English
A medium-severity heap buffer overflow in Assimp from Open Asset Import Library. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A weakness has been identified in Open Asset Import Library Assimp 6.0.2. This affects the function Q3DImporter::InternReadFile of the file assimp/code/AssetLib/Q3D/Q3DLoader.cpp. Executing a manipulation can lead to heap-based buffer overflow. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:9 | qt5-qt3d | 5.15.9-2.el9_7.1 | ALSA-2025:20963 |
| AlmaLinux:9 | qt5-qt3d-devel | 5.15.9-2.el9_7.1 | ALSA-2025:20963 |
| AlmaLinux:9 | qt5-qt3d-examples | 5.15.9-2.el9_7.1 | ALSA-2025:20963 |
| AlmaLinux:10 | qt6-qtquick3d | 6.9.1-1.el10_1.1 | ALSA-2025:22361 |
| AlmaLinux:10 | qt6-qtquick3d-devel | 6.9.1-1.el10_1.1 | ALSA-2025:22361 |
| AlmaLinux:10 | qt6-qtquick3d-examples | 6.9.1-1.el10_1.1 | ALSA-2025:22361 |
| Alpine:v3.23 | assimp | 6.0.4-r0 | ALPINE-CVE-2025-11277 |
| Alpine:v3.24 | assimp | 6.0.4-r0 | ALPINE-CVE-2025-11277 |
| Debian:12 | assimp | no fix listed | DEBIAN-CVE-2025-11277 |
| Debian:13 | assimp | no fix listed | DEBIAN-CVE-2025-11277 |
| Debian:14 | assimp | 6.0.3+ds-1 | DEBIAN-CVE-2025-11277 |
| PyPI | pyassimp | no fix listed | PYSEC-2025-157 |
| Rocky Linux:9 | qt5-qt3d | 0:5.15.9-2.el9_7.1 | RLSA-2025:20963 |
| Rocky Linux:9 | qt5-qt3d | 0:5.15.9-2.el9_7.1 | RLSA-2025:19911 |
| Rocky Linux:10 | qt6-qtquick3d | 0:6.9.1-1.el10_1.1 | RLSA-2025:22361 |
| Ubuntu:22.04:LTS | assimp | no fix listed | UBUNTU-CVE-2025-11277 |
| Ubuntu:24.04:LTS | assimp | no fix listed | UBUNTU-CVE-2025-11277 |
| Ubuntu:25.10 | assimp | no fix listed | UBUNTU-CVE-2025-11277 |
| Ubuntu:26.04:LTS | assimp | no fix listed | UBUNTU-CVE-2025-11277 |
| Ubuntu:26.10 | assimp | no fix listed | UBUNTU-CVE-2025-11277 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Open Asset Import Library | Assimp | 6.0.2 |
Weakness: CWE-122, CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-327011 | Open Asset Import Library Assimp Q3DLoader.cpp InternReadFile heap-based overflow vdb-entry, technical-description
- VDB-327011 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- Submit #658912 | Open Asset Import Library Assimp 6.0.2 / master commit 0581ed5 Heap-based Buffer Overflow third-party-advisory
- https://github.com/assimp/assimp/issues/6358 issue-tracking
- https://github.com/user-attachments/files/22422643/poc.zip exploit