CVE-2025-5166
published 2025-05-26CVE-2025-5166: A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as problematic. Affected is the function…
PriorityP423medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.21%
10.9th percentile
A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as problematic. Affected is the function MDCImporter::InternReadFile of the file assimp/code/AssetLib/MDC/MDCLoader.cpp of the component MDC File Parser. The manipulation of the argument pcVerts leads to out-of-bounds read. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| assimp | assimp | — | — |
| assimp | assimp | >= 0 < 6.0.3+ds-1 | 6.0.3+ds-1 |
| debian | assimp | < assimp 6.0.3+ds-1 (forky) | assimp 6.0.3+ds-1 (forky) |
| open_asset_import_library | assimp | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv4.04.8MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.01.7LOWAV:L/AC:L/Au:S/C:N/I:N/A:P
osv4.8MEDIUM
vendor_debian4.8MEDIUM
vendor_redhat4.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
assimp: Assimp MDC File Parser Out-of-Bounds Read
vendor_redhat·2025-05-26·CVSS 4.8
CVE-2025-5166 [MEDIUM] CWE-119 assimp: Assimp MDC File Parser Out-of-Bounds Read
assimp: Assimp MDC File Parser Out-of-Bounds Read
A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as problematic. Affected is the function MDCImporter::InternReadFile of the file assimp/code/AssetLib/MDC/MDCLoader.cpp of the component MDC File Parser. The manipulation of the argument pcVerts leads to out-of-bounds read. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
A flaw was found in the Open Asset Import Library (Assimp) MDC File Parser. This vulnerability allows out-of-bounds memory reads via manipulation of a function argument.
Package: qt5-qt3d (Red Hat Enterprise Linux 9) - N
Debian
CVE-2025-5166: assimp - A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been...
vendor_debian·2025·CVSS 4.8
CVE-2025-5166 [MEDIUM] CVE-2025-5166: assimp - A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been...
A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as problematic. Affected is the function MDCImporter::InternReadFile of the file assimp/code/AssetLib/MDC/MDCLoader.cpp of the component MDC File Parser. The manipulation of the argument pcVerts leads to out-of-bounds read. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 6.0.3+ds-1)
sid: resolved (fixed in 6.0.3+ds-1)
trixie: open
GHSA
GHSA-jg2v-6g6x-hx35: A vulnerability was found in Open Asset Import Library Assimp 5
ghsa_unreviewed·2025-05-26
CVE-2025-5166 [MEDIUM] CWE-119 GHSA-jg2v-6g6x-hx35: A vulnerability was found in Open Asset Import Library Assimp 5
A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as problematic. Affected is the function MDCImporter::InternReadFile of the file assimp/code/AssetLib/MDC/MDCLoader.cpp of the component MDC File Parser. The manipulation of the argument pcVerts leads to out-of-bounds read. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
OSV
CVE-2025-5166: A vulnerability was found in Open Asset Import Library Assimp 5
osv·2025-05-26·CVSS 4.8
CVE-2025-5166 [MEDIUM] CVE-2025-5166: A vulnerability was found in Open Asset Import Library Assimp 5
A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as problematic. Affected is the function MDCImporter::InternReadFile of the file assimp/code/AssetLib/MDC/MDCLoader.cpp of the component MDC File Parser. The manipulation of the argument pcVerts leads to out-of-bounds read. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-05-26
Published