{"id":"CVE-2025-2592","aliases":["DEBIAN-CVE-2025-2592","EUVD-2025-7248","GHSA-gq4x-2qp9-2gvw","PYSEC-2025-260","SUSE-SU-2026:21821-1","UBUNTU-CVE-2025-2592","openSUSE-SU-2025:0113-1","openSUSE-SU-2025:0117-1","openSUSE-SU-2025:14950-1","openSUSE-SU-2026:20781-1"],"status":"published","title":"Open Asset Import Library Assimp CSMLoader.cpp InternReadFile heap-based overflow","description":"A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named 2690e354da0c681db000cfd892a55226788f2743. It is recommended to apply a patch to fix this issue.","severity":{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00741,"percentile":0.54926,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-122"],"published":"2025-03-21T14:00:18Z","modified":"2026-10-28T10:58:49Z","fixes":[{"ecosystem":"Debian:14","package":"assimp","fixed_in":["6.0.2+ds-1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP6","package":"doomsday","fixed_in":["2.3.1-bp156.4.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"doomsday","fixed_in":["2.3.1-bp156.4.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.5~ds0-1","5.2.5~ds0-1.1","5.3.1+ds-1","5.3.1+ds-2","5.4.0+ds-1","5.4.1+ds-1","5.4.2+ds-1","5.4.3+ds-2","5.4.3+ds-3","6.0.2+ds-1","6.0.3+ds-1","6.0.4+ds-1","6.0.4+ds-3","6.0.5+ds-1"]},{"source":"osv","ecosystem":"Debian:13","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.3+ds-2","5.4.3+ds-3","6.0.2+ds-1","6.0.3+ds-1","6.0.4+ds-1","6.0.4+ds-3","6.0.5+ds-1"]},{"source":"osv","ecosystem":"Debian:14","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.2+ds-1"}]}],"versions":["5.4.3+ds-2","5.4.3+ds-3"]},{"source":"osv","ecosystem":"PyPI","package":"pyassimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.4.3"}]}],"versions":["0.1","3.3","4.1.1","4.1.2","4.1.3","4.1.4","5.2.5"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0~dfsg-4ubuntu4","3.1.1~dfsg-5","3.2~dfsg-1","3.2~dfsg-2","3.2~dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.1~dfsg-5","3.3.1~dfsg-5ubuntu1","3.3.1~dfsg-5+build1","4.0.1~dfsg-1~exp2","4.0.1~dfsg-1","4.1.0~dfsg-1","4.1.0~dfsg-2","4.1.0~dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.0~dfsg-5","4.1.0~dfsg-5ubuntu1","5.0.1~ds0-1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.1~ds0-2","5.0.1~ds0-3ubuntu1","5.1.4~ds0-1","5.1.5~ds0-1","5.1.6~ds0-1","5.2.0~ds0-2","5.2.1~ds0-1","5.2.2~ds0-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.5~ds0-1.1build1","5.3.1+ds-1","5.3.1+ds-2","5.3.1+ds-2build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.3+ds-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.4+ds-1build1","6.0.5+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.3+ds-2","6.0.2+ds-1","6.0.3+ds-1","6.0.4+ds-1","6.0.4+ds-1build1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP6","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1-bp156.3.9.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1-bp156.3.9.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP6","package":"doomsday","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-bp156.4.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"doomsday","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-bp156.4.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.3-5.1"}]}],"bundled":4}],"products":[{"vendor":"assimp","product":"assimp"},{"vendor":"open asset import library","product":"assimp"}],"references":[{"url":"https://vuldb.com/?id.300575","tags":["vdb-entry","technical-description","Third Party Advisory","VDB Entry","advisory","report"]},{"url":"https://vuldb.com/?ctiid.300575","tags":["signature","permissions-required","Permissions Required","VDB Entry","report"]},{"url":"https://vuldb.com/?submit.517782","tags":["third-party-advisory","Third Party Advisory","VDB Entry","advisory","report"]},{"url":"https://github.com/assimp/assimp/issues/6010","tags":["issue-tracking","Exploit","Issue Tracking","report"]},{"url":"https://github.com/assimp/assimp/pull/6052","tags":["issue-tracking","Patch","report","fix"]},{"url":"https://github.com/assimp/assimp/issues/6010#issue-2877368110","tags":["exploit","issue-tracking","Exploit","Issue Tracking","report"]},{"url":"https://github.com/assimp/assimp/commit/2690e354da0c681db000cfd892a55226788f2743","tags":["patch","Patch","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2592","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-gq4x-2qp9-2gvw"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/2xxx/CVE-2025-2592.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-2592","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621821-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1239220","tags":["report"]},{"url":"https://bugzilla.suse.com/1239916","tags":["report"]},{"url":"https://bugzilla.suse.com/1239920","tags":["report"]},{"url":"https://bugzilla.suse.com/1240412","tags":["report"]},{"url":"https://bugzilla.suse.com/1241367","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-2151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-2591","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-2592","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3548","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-2592","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-2592","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GUXUVZ7SBZK5ZFR45B223UXCWUMD4XQD/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1232322","tags":["report"]},{"url":"https://bugzilla.suse.com/1232323","tags":["report"]},{"url":"https://bugzilla.suse.com/1232324","tags":["report"]},{"url":"https://bugzilla.suse.com/1233633","tags":["report"]},{"url":"https://bugzilla.suse.com/1240413","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48423","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48424","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3016","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/S3ZMAN5677TB6D5IC67FGAVTSCVBDT3B/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1239917","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IVB5I4E2WYMZHY5UCOCLR75CX3WJV47A/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-2592","title":"Open Asset Import Library Assimp CSMLoader.cpp InternReadFile heap-based overflow","description":"A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named 2690e354da0c681db000cfd892a55226788f2743. It is recommended to apply a patch to fix this issue.","status":"published","published":"2025-03-21T14:00:18.48Z","modified":"2025-03-21T14:25:58.496Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"},{"version":"3.0","score":6.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","assessor":"cna"}],"cwes":["CWE-122","CWE-119"],"updated_at":"2026-11-02T14:32:38.70481Z"}],"euvd":[{"id":"EUVD-2025-7248","description":"A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named 2690e354da0c681db000cfd892a55226788f2743. It is recommended to apply a patch to fix this issue.","status":"published","published":"2025-03-21T14:00:18Z","modified":"2025-03-21T14:25:58Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T20:52:56.049523Z"}],"ghsa":[{"id":"GHSA-gq4x-2qp9-2gvw","title":"A vulnerability, which was classified as critical, has been found in Open Asset Import Library...","description":"A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named 2690e354da0c681db000cfd892a55226788f2743. It is recommended to apply a patch to fix this issue.","status":"published","published":"2025-03-21T15:31:15Z","modified":"2025-03-21T15:31:15Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T15:00:23.592031Z"}],"nvd":[{"id":"CVE-2025-2592","description":"A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named 2690e354da0c681db000cfd892a55226788f2743. It is recommended to apply a patch to fix this issue.","status":"published","published":"2025-03-21T14:15:17.037Z","modified":"2026-06-17T09:07:14.743Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"secondary"}],"cwes":["CWE-119","CWE-122"],"updated_at":"2026-11-02T14:10:54.744127Z"}],"osv":[{"id":"CVE-2025-2592","title":"Open Asset Import Library Assimp CSMLoader.cpp InternReadFile heap-based overflow","description":"A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named 2690e354da0c681db000cfd892a55226788f2743. It is recommended to apply a patch to fix this issue.","status":"published","published":"2025-03-21T14:00:18.48Z","modified":"2026-10-28T10:58:49.178244777Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-119","CWE-122"],"updated_at":"2026-11-02T15:44:47.386092Z"},{"id":"DEBIAN-CVE-2025-2592","description":"A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named 2690e354da0c681db000cfd892a55226788f2743. It is recommended to apply a patch to fix this issue.","status":"published","published":"2025-03-21T14:15:17.037Z","modified":"2026-09-01T20:05:44.776731561Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:45.870237Z"},{"id":"PYSEC-2025-260","description":"A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named 2690e354da0c681db000cfd892a55226788f2743. It is recommended to apply a patch to fix this issue.","status":"published","published":"2025-03-21T14:15:17.037Z","modified":"2026-07-13T07:15:40.767756817Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:54.242332Z"},{"id":"UBUNTU-CVE-2025-2592","description":"A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named 2690e354da0c681db000cfd892a55226788f2743. It is recommended to apply a patch to fix this issue.","status":"published","published":"2025-03-21T14:15:00Z","modified":"2026-10-17T12:56:49.234067188Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:55:26.330196Z"},{"id":"openSUSE-SU-2025:0113-1","title":"Security update for assimp","description":"This update for assimp fixes the following issues:\n\n- CVE-2024-48425: Fixed SEGV in Assimp:SplitLargeMeshesProcess_Triangle:UpdateNode (boo#1232324)\n- CVE-2024-48423: Fixed a arbitrary code execution via CallbackToLogRedirector() (boo#1232322)\n- CVE-2024-48424: Fixed a heap-buffer-overflow in OpenDDLParser:parseStructure() (boo#1232323)\n- CVE-2024-53425: Fixed a heap-based buffer overflow in SkipSpacesAndLineEnd() (boo#1233633)\n- CVE-2025-2592: Fixed a heap-based buffer overflow in Assimp::CSMImporter::InternReadFile() (boo#1239916)\n- CVE-2025-3015: Fixed out-of-bounds read caused by manipulation of the argument mIndices (boo#1240412)\n- CVE-2025-3016: Fixed a denial of service caused by manipulation of the argument mWidth/mHeight (boo#1240413)\n- CVE-2025-2591: Fixed a denial of service in code/AssetLib/MDL/MDLLoader.cpp (boo#1239920)\n- CVE-2025-2151: Fixed a stack-based buffer overflow in Assimp::GetNextLine() (boo#1239220)\n","status":"published","published":"2025-04-02T16:31:31Z","modified":"2026-02-04T04:10:58.651803Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2025:0117-1","title":"Security update for doomsday","description":"This update for doomsday fixes the following issues:\n\n- CVE-2025-2592: Use system assimp library to fix a heap-based buffer overflow (boo#1239917)\n","status":"published","published":"2025-04-09T06:48:33Z","modified":"2026-02-04T03:27:26.54109Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2025:14950-1","title":"assimp-devel-5.4.3-5.1 on GA media","description":"These are all security issues fixed in the assimp-devel-5.4.3-5.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-04-02T00:00:00Z","modified":"2026-02-04T02:14:44.357618Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2026:20781-1","title":"Security update for assimp","description":"This update for assimp fixes the following issues\n\n- CVE-2025-2151: vulnerability affects the function Assimp: GetNextLine in the library ParsingUtils.h (bsc#1239220).\n- CVE-2025-2591: division by zero in code/AssetLib/MDL/MDLLoader.cpp (bsc#1239920).\n- CVE-2025-2592: heap-based buffer overflow in Assimp: CSMImporter: InternReadFile of code/AssetLib/CSM/CSMLoader.cpp\n  (bsc#1239916).\n- CVE-2025-3015: manipulation of the argument mIndices leads to out-of-bounds read (bsc#1240412).\n- CVE-2025-3548: processing of malformed files may leads to an out-of-bounds read and potential application crash\n  (bsc#1241367).\n","status":"published","published":"2026-05-19T09:47:34Z","modified":"2026-05-26T18:24:12.496959494Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:21821-1","title":"Security update for assimp","description":"This update for assimp fixes the following issues\n\n- CVE-2025-2151: vulnerability affects the function Assimp: GetNextLine in the library ParsingUtils.h (bsc#1239220).\n- CVE-2025-2591: division by zero in code/AssetLib/MDL/MDLLoader.cpp (bsc#1239920).\n- CVE-2025-2592: heap-based buffer overflow in Assimp: CSMImporter: InternReadFile of code/AssetLib/CSM/CSMLoader.cpp\n  (bsc#1239916).\n- CVE-2025-3015: manipulation of the argument mIndices leads to out-of-bounds read (bsc#1240412).\n- CVE-2025-3548: processing of malformed files may leads to an out-of-bounds read and potential application crash\n  (bsc#1241367).\n","status":"published","published":"2026-05-19T09:46:29Z","modified":"2026-05-28T18:24:12.853813787Z","updated_at":"2026-11-02T15:54:02.654057Z"}]}}