Vulnerability · Published Mar 31, 2025 · Assigned by VulDB

CVE-2025-3016Open Asset Import Library Assimp MDL File MDLMaterialLoader.cpp ParseTextureColorData resource consumption

Medium 4.3

In plain English

A medium-severity uncontrolled resource consumption in Assimp from Open Asset Import Library. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.7%top 47.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::MDLImporter::ParseTextureColorData of the file code/AssetLib/MDL/MDLMaterialLoader.cpp of the component MDL File Handler. The manipulation of the argument mWidth/mHeight leads to resource consumption. The attack can be initiated remotely. Upgrading to version 6.0 is able to address this issue. The name of the patch is 5d2a7482312db2e866439a8c05a07ce1e718bed1. It is recommended to apply a patch to fix this issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	assimp	no fix listed	DEBIAN-CVE-2025-3016
Debian:13	assimp	no fix listed	DEBIAN-CVE-2025-3016
Debian:14	assimp	6.0.2+ds-1	DEBIAN-CVE-2025-3016
PyPI	pyassimp	no fix listed	PYSEC-2025-262
Ubuntu:22.04:LTS	assimp	no fix listed	UBUNTU-CVE-2025-3016
Ubuntu:24.04:LTS	assimp	no fix listed	UBUNTU-CVE-2025-3016
Ubuntu:25.10	assimp	no fix listed	UBUNTU-CVE-2025-3016
Ubuntu:26.04:LTS	assimp	no fix listed	UBUNTU-CVE-2025-3016
Ubuntu:26.10	assimp	no fix listed	UBUNTU-CVE-2025-3016

Affected products (as reported)

Vendor	Product	Versions
Open Asset Import Library	Assimp	5.4.3

Weakness: CWE-400, CWE-404 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

References

VDB-302068 | Open Asset Import Library Assimp MDL File MDLMaterialLoader.cpp ParseTextureColorData resource consumption vdb-entry, technical-description
VDB-302068 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #524593 | Open Asset Import Library Assimp >=5.4.3 Uncontrolled Memory Allocation third-party-advisory
https://github.com/assimp/assimp/issues/6022 issue-tracking
https://github.com/assimp/assimp/pull/6046 issue-tracking
https://github.com/assimp/assimp/commit/5d2a7482312db2e866439a8c05a07ce1e718bed1 patch