{"id":"CVE-2025-2751","aliases":["DEBIAN-CVE-2025-2751","EUVD-2025-8071","GHSA-345v-qrhv-w227","MGASA-2026-0170","OESA-2025-2178","OESA-2025-2179","OESA-2025-2252","OESA-2026-2053","OESA-2026-2054","PYSEC-2025-162","UBUNTU-CVE-2025-2751","openSUSE-SU-2025:15209-1"],"status":"published","title":"Open Asset Import Library Assimp CSM File CSMLoader.cpp InternReadFile out-of-bounds","description":"A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. The manipulation of the argument na leads to out-of-bounds read. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.","severity":{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00822,"percentile":0.57761,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-125"],"published":"2025-03-25T07:31:05Z","modified":"2026-10-28T02:30:58Z","fixes":[{"ecosystem":"Debian:14","package":"assimp","fixed_in":["6.0.2+ds-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.5~ds0-1","5.2.5~ds0-1.1","5.3.1+ds-1","5.3.1+ds-2","5.4.0+ds-1","5.4.1+ds-1","5.4.2+ds-1","5.4.3+ds-2","5.4.3+ds-3","6.0.2+ds-1","6.0.3+ds-1","6.0.4+ds-1","6.0.4+ds-3","6.0.5+ds-1"]},{"source":"osv","ecosystem":"Debian:13","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.3+ds-2","5.4.3+ds-3","6.0.2+ds-1","6.0.3+ds-1","6.0.4+ds-1","6.0.4+ds-3","6.0.5+ds-1"]},{"source":"osv","ecosystem":"Debian:14","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.2+ds-1"}]}],"versions":["5.4.3+ds-2","5.4.3+ds-3"]},{"source":"osv","ecosystem":"Mageia:9","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-1.mga9"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1-10.oe2403sp2"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1-10.oe2403sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1-10.oe2403"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.1-29.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.4-15.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"pyassimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.4.3"}]}],"versions":["0.1","3.3","4.1.1","4.1.2","4.1.3","4.1.4","5.2.5"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0~dfsg-4ubuntu4","3.1.1~dfsg-5","3.2~dfsg-1","3.2~dfsg-2","3.2~dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.1~dfsg-5","3.3.1~dfsg-5ubuntu1","3.3.1~dfsg-5+build1","4.0.1~dfsg-1~exp2","4.0.1~dfsg-1","4.1.0~dfsg-1","4.1.0~dfsg-2","4.1.0~dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.0~dfsg-5","4.1.0~dfsg-5ubuntu1","5.0.1~ds0-1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.1~ds0-2","5.0.1~ds0-3ubuntu1","5.1.4~ds0-1","5.1.5~ds0-1","5.1.6~ds0-1","5.2.0~ds0-2","5.2.1~ds0-1","5.2.2~ds0-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.5~ds0-1.1build1","5.3.1+ds-1","5.3.1+ds-2","5.3.1+ds-2build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.3+ds-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.4+ds-1build1","6.0.5+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.3+ds-2","6.0.2+ds-1","6.0.3+ds-1","6.0.4+ds-1","6.0.4+ds-1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"assimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.2-1.1"}]}],"bundled":5}],"products":[{"vendor":"assimp","product":"assimp"},{"vendor":"open asset import library","product":"assimp"}],"references":[{"url":"https://vuldb.com/?id.300856","tags":["vdb-entry","technical-description","Third Party Advisory","VDB Entry","advisory","report"]},{"url":"https://vuldb.com/?ctiid.300856","tags":["signature","permissions-required","Permissions Required","VDB Entry","report"]},{"url":"https://vuldb.com/?submit.517785","tags":["third-party-advisory","Third Party Advisory","VDB Entry","advisory","report"]},{"url":"https://github.com/assimp/assimp/issues/6012","tags":["issue-tracking","Exploit","Issue Tracking","report"]},{"url":"https://github.com/assimp/assimp/issues/6012#issue-2877369817","tags":["exploit","issue-tracking","Exploit","Issue Tracking","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2751","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-345v-qrhv-w227"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/2xxx/CVE-2025-2751.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-2751","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0170.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34439","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZYGDCFEL3GZ5PDUZFKEVVISQWAENNBTB/","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/2LQLM3OX7KPUJNJSKSVDROFQGZRJPVRF/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2178","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3158","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3196","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2179","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2252","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2053","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-48424","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2054","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-2751","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-2751","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-2750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-2751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-2757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3548","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-2751","title":"Open Asset Import Library Assimp CSM File CSMLoader.cpp InternReadFile out-of-bounds","description":"A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. The manipulation of the argument na leads to out-of-bounds read. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.","status":"published","published":"2025-03-25T07:31:05.393Z","modified":"2025-03-31T17:34:52.202Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"},{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","assessor":"cna"}],"cwes":["CWE-125","CWE-119"],"updated_at":"2026-11-02T14:32:38.70481Z"}],"euvd":[{"id":"EUVD-2025-8071","description":"A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. The manipulation of the argument na leads to out-of-bounds read. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.","status":"published","published":"2025-03-25T07:31:05Z","modified":"2025-03-31T17:34:52Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T20:52:46.759966Z"}],"ghsa":[{"id":"GHSA-345v-qrhv-w227","title":"A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as...","description":"A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. The manipulation of the argument na leads to out-of-bounds read. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.","status":"published","published":"2025-03-25T09:32:06Z","modified":"2025-03-25T09:32:14Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T15:00:25.909155Z"}],"nvd":[{"id":"CVE-2025-2751","description":"A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. The manipulation of the argument na leads to out-of-bounds read. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.","status":"published","published":"2025-03-25T08:15:20.013Z","modified":"2026-06-17T09:07:33.683Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"secondary"}],"cwes":["CWE-119","CWE-125"],"updated_at":"2026-11-02T14:10:55.858901Z"}],"osv":[{"id":"CVE-2025-2751","title":"Open Asset Import Library Assimp CSM File CSMLoader.cpp InternReadFile out-of-bounds","description":"A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. The manipulation of the argument na leads to out-of-bounds read. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.","status":"published","published":"2025-03-25T07:31:05.393Z","modified":"2026-10-28T02:30:58.468499262Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-119","CWE-125"],"updated_at":"2026-11-02T15:44:47.708311Z"},{"id":"DEBIAN-CVE-2025-2751","description":"A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. The manipulation of the argument na leads to out-of-bounds read. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.","status":"published","published":"2025-03-25T08:15:20.013Z","modified":"2026-09-01T20:05:45.225298828Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:45.870237Z"},{"id":"OESA-2025-2178","title":"assimp security update","description":"Assimp is a library to load and process geometric scenes from various data formats. Assimp aims to provide a full asset conversion pipeline for use in game engines and real-time rendering systems of any kind, but is not limited to this purpose.\r\n\r\nSecurity Fix(es):\n\nA vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. The manipulation of the argument na leads to out-of-bounds read. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.(CVE-2025-2751)\n\nA vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. Affected by this issue is the function Assimp::LWO::AnimResolver::UpdateAnimRangeSetup of the file code/AssetLib/LWO/LWOAnimation.cpp of the component LWO File Handler. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.(CVE-2025-3158)\n\nA vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. Affected is the function Assimp::MD2Importer::InternReadFile in the library code/AssetLib/MD2/MD2Loader.cpp of the component Malformed File Handler. The manipulation of the argument Name leads to stack-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.(CVE-2025-3196)","status":"published","published":"2025-09-05T11:09:15Z","modified":"2026-08-18T01:18:40.18227725Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2179","title":"assimp security update","description":"Assimp is a library to load and process geometric scenes from various data formats. Assimp aims to provide a full asset conversion pipeline for use in game engines and real-time rendering systems of any kind, but is not limited to this purpose.\r\n\r\nSecurity Fix(es):\n\nA vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. The manipulation of the argument na leads to out-of-bounds read. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.(CVE-2025-2751)\n\nA vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. Affected by this issue is the function Assimp::LWO::AnimResolver::UpdateAnimRangeSetup of the file code/AssetLib/LWO/LWOAnimation.cpp of the component LWO File Handler. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.(CVE-2025-3158)\n\nA vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. Affected is the function Assimp::MD2Importer::InternReadFile in the library code/AssetLib/MD2/MD2Loader.cpp of the component Malformed File Handler. The manipulation of the argument Name leads to stack-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.(CVE-2025-3196)","status":"published","published":"2025-09-05T11:09:15Z","modified":"2026-08-18T01:18:34.548379472Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2252","title":"assimp security update","description":"Assimp is a library to load and process geometric scenes from various data formats. Assimp aims to provide a full asset conversion pipeline for use in game engines and real-time rendering systems of any kind, but is not limited to this purpose.\r\n\r\nSecurity Fix(es):\n\nA vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. The manipulation of the argument na leads to out-of-bounds read. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.(CVE-2025-2751)\n\nA vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. Affected by this issue is the function Assimp::LWO::AnimResolver::UpdateAnimRangeSetup of the file code/AssetLib/LWO/LWOAnimation.cpp of the component LWO File Handler. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.(CVE-2025-3158)\n\nA vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. Affected is the function Assimp::MD2Importer::InternReadFile in the library code/AssetLib/MD2/MD2Loader.cpp of the component Malformed File Handler. The manipulation of the argument Name leads to stack-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.(CVE-2025-3196)","status":"published","published":"2025-09-12T11:09:19Z","modified":"2026-08-18T01:19:09.449991058Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2026-2053","title":"assimp security update","description":"Assimp is a library to load and process geometric scenes from various data formats. Assimp aims to provide a full asset conversion pipeline for use in game engines and real-time rendering systems of any kind, but is not limited to this purpose.\r\n\r\nSecurity Fix(es):\n\nA heap-buffer-overflow vulnerability has been identified in the OpenDDLParser::parseStructure function within the Assimp library, specifically during the processing of OpenGEX files.(CVE-2024-48424)\n\nA vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. The manipulation of the argument na leads to out-of-bounds read. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.(CVE-2025-2751)","status":"published","published":"2026-04-25T11:11:03Z","modified":"2026-08-18T01:19:48.526365618Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2054","title":"assimp security update","description":"Assimp is a library to load and process geometric scenes from various data formats. Assimp aims to provide a full asset conversion pipeline for use in game engines and real-time rendering systems of any kind, but is not limited to this purpose.\r\n\r\nSecurity Fix(es):\n\nA heap-buffer-overflow vulnerability has been identified in the OpenDDLParser::parseStructure function within the Assimp library, specifically during the processing of OpenGEX files.(CVE-2024-48424)\n\nA vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. The manipulation of the argument na leads to out-of-bounds read. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.(CVE-2025-2751)","status":"published","published":"2026-04-25T11:11:03Z","modified":"2026-08-18T01:19:49.045563399Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"PYSEC-2025-162","description":"A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. The manipulation of the argument na leads to out-of-bounds read. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.","status":"published","published":"2025-03-25T08:15:20.013Z","modified":"2026-05-21T15:00:20.869052109Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:54.242332Z"},{"id":"UBUNTU-CVE-2025-2751","description":"A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. The manipulation of the argument na leads to out-of-bounds read. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.","status":"published","published":"2025-03-25T08:15:00Z","modified":"2026-10-17T12:56:49.396658235Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:55:26.330196Z"},{"id":"MGASA-2026-0170","title":"Updated assimp packages fix security vulnerabilities","description":"CVE-2025-2750,- A vulnerability, which was classified as critical, was\nfound in Open Asset Import Library Assimp 5.4.3. This affects the\nfunction Assimp::CSMImporter::InternReadFile of the file\ncode/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. The\nmanipulation leads to out-of-bounds write. It is possible to initiate\nthe attack remotely. The exploit has been disclosed to the public and\nmay be used.\nCVE-2025-2757, A vulnerability classified as critical was found in Open\nAsset Import Library Assimp 5.4.3. This vulnerability affects the\nfunction AI_MD5_PARSE_STRING_IN_QUOTATION of the file\ncode/AssetLib/MD5/MD5Parser.cpp of the component MD5 File Handler. The\nmanipulation of the argument data leads to heap-based buffer overflow.\nThe attack can be initiated remotely. The exploit has been disclosed to\nthe public and may be used.\nCVE-2025-2757, A vulnerability classified as critical was found in Open\nAsset Import Library Assimp 5.4.3. This vulnerability affects the\nfunction AI_MD5_PARSE_STRING_IN_QUOTATION of the file\ncode/AssetLib/MD5/MD5Parser.cpp of the component MD5 File Handler. The\nmanipulation of the argument data leads to heap-based buffer overflow.\nThe attack can be initiated remotely. The exploit has been disclosed to\nthe public and may be used.\nCVE-2025-3158, A vulnerability, which was classified as critical, has\nbeen found in Open Asset Import Library Assimp 5.4.3. Affected by this\nissue is the function Assimp::LWO::AnimResolver::UpdateAnimRangeSetup of\nthe file code/AssetLib/LWO/LWOAnimation.cpp of the component LWO File\nHandler. The manipulation leads to heap-based buffer overflow. It is\npossible to launch the attack on the local host. The exploit has been\ndisclosed to the public and may be used.\nCVE-2025-3548,  A vulnerability, which was classified as critical, has\nbeen found in Open Asset Import Library Assimp up to 5.4.3. This issue\naffects the function aiString::Set in the library include/assimp/types.h\nof the component File Handler. The manipulation leads to heap-based\nbuffer overflow. It is possible to launch the attack on the local host.\nThe exploit has been disclosed to the public and may be used. It is\nrecommended to apply a patch to fix this issue.\nCVE-2025-11277, A weakness has been identified in Open Asset Import\nLibrary Assimp 6.0.2. This affects the function\nQ3DImporter::InternReadFile of the file\nassimp/code/AssetLib/Q3D/Q3DLoader.cpp. Executing a manipulation can\nlead to heap-based buffer overflow. The attack needs to be launched\nlocally. The exploit has been made available to the public and could be\nused for attacks.\nCVE-2025-70067, Buffer Overflow vulnerability exists in Assimp versions\nup to 6.0.2 in the FBX Importer. The vulnerability occurs in\naiMaterial::AddBinaryProperty, where a property key string from a\ncrafted FBX file is copied into a fixed-size heap buffer using strcpy()\nwithout runtime length validation\n","status":"published","published":"2026-06-02T05:23:04Z","modified":"2026-06-02T05:48:04.147797409Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:15209-1","title":"assimp-devel-6.0.2-1.1 on GA media","description":"These are all security issues fixed in the assimp-devel-6.0.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:30.00598Z","updated_at":"2026-11-02T16:58:37.399567Z"}]}}