Out-of-Bounds Read Vulnerability in Open Asset Import Library Assimp
CVE-2025-5200
Key Information:
- Vendor
Open Asset Import Library
- Status
- Vendor
- CVE Published:
- 26 May 2025
Badges
What is CVE-2025-5200?
A flaw exists in the Open Asset Import Library (Assimp) version 5.4.3 affecting the MDLImporter::InternReadFile_Quake1 function located in the MDLLoader.cpp file. This vulnerability allows an attacker to perform out-of-bounds reads, potentially leading to information disclosure or other unforeseen behaviors when processing certain asset files. The vulnerability is exploitable locally, emphasizing the need for users to be cautious in environments where untrusted content could be processed. Developers have acknowledged the issue and have indicated plans to compile all related vulnerabilities into a single thread for resolution.
Affected Version(s)
Assimp 5.4.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.