Log in Start free

Vulnerability · Published Mar 21, 2025 · Assigned by VulDB

CVE-2025-2592Open Asset Import Library Assimp CSMLoader.cpp InternReadFile heap-based overflow

Medium 6.3

In plain English

A medium-severity heap buffer overflow in Assimp from Open Asset Import Library. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.7%top 45.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named 2690e354da0c681db000cfd892a55226788f2743. It is recommended to apply a patch to fix this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12assimpno fix listedDEBIAN-CVE-2025-2592
Debian:13assimpno fix listedDEBIAN-CVE-2025-2592
Debian:14assimp6.0.2+ds-1DEBIAN-CVE-2025-2592
PyPIpyassimpno fix listedPYSEC-2025-260
Ubuntu:22.04:LTSassimpno fix listedUBUNTU-CVE-2025-2592
Ubuntu:24.04:LTSassimpno fix listedUBUNTU-CVE-2025-2592
Ubuntu:25.10assimpno fix listedUBUNTU-CVE-2025-2592
Ubuntu:26.04:LTSassimpno fix listedUBUNTU-CVE-2025-2592
Ubuntu:26.10assimpno fix listedUBUNTU-CVE-2025-2592

Affected products (as reported)

VendorProductVersions
Open Asset Import Library Assimp 5.4.3

Weakness: CWE-122, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

References