CVE-2025-2757: A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function…

medium5.3CVSS 4.0

AVNACLATNPRNUIPVCLVILVALSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX

A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function AI_MD5_PARSE_STRING_IN_QUOTATION of the file code/AssetLib/MD5/MD5Parser.cpp of the component MD5 File Handler. The manipulation of the argument data leads to heap-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
assimp	assimp	—	—
assimp	assimp	>= 0 < 6.0.2+ds-1	6.0.2+ds-1
debian	assimp	< assimp 6.0.2+ds-1 (forky)	assimp 6.0.2+ds-1 (forky)
msrc	azl3_php_8.3.4-1_on_azure_linux_3.0	—	—
msrc	azl3_php_8.3.6-1_on_azure_linux_3.0	—	—
msrc	azure_linux_3.0_arm	—	—
msrc	azure_linux_3.0_x64	—	—
open_asset_import_library	assimp	—	—

CVSS provenance

nvdv4.05.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

osv5.3MEDIUM