Log in Start free

Vulnerability · Published Apr 3, 2025 · Assigned by VulDB

CVE-2025-3159Open Asset Import Library Assimp ASE File ASEParser.cpp ParseLV4MeshBonesVertices heap-based overflow

Medium 5.3

In plain English

A medium-severity heap buffer overflow in Assimp from Open Asset Import Library. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.3%top 73.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASE::Parser::ParseLV4MeshBonesVertices of the file code/AssetLib/ASE/ASEParser.cpp of the component ASE File Handler. The manipulation leads to heap-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is e8a6286542924e628e02749c4f5ac4f91fdae71b. It is recommended to apply a patch to fix this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12assimpno fix listedDEBIAN-CVE-2025-3159
Debian:13assimpno fix listedDEBIAN-CVE-2025-3159
Debian:14assimp6.0.2+ds-1DEBIAN-CVE-2025-3159
PyPIpyassimpno fix listedPYSEC-2025-263
Rocky Linux:9qt5-qt3d0:5.15.9-2.el9_6RLSA-2025:12842
Ubuntu:22.04:LTSassimpno fix listedUBUNTU-CVE-2025-3159
Ubuntu:24.04:LTSassimpno fix listedUBUNTU-CVE-2025-3159
Ubuntu:25.10assimpno fix listedUBUNTU-CVE-2025-3159
Ubuntu:26.04:LTSassimpno fix listedUBUNTU-CVE-2025-3159
Ubuntu:26.10assimpno fix listedUBUNTU-CVE-2025-3159

Affected products (as reported)

VendorProductVersions
Open Asset Import Library Assimp 5.4.3

Weakness: CWE-122, CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References