CVE-2025-3159

Name
CVE-2025-3159
Description
A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASE::Parser::ParseLV4MeshBonesVertices of the file code/AssetLib/ASE/ASEParser.cpp of the component ASE File Handler. The manipulation leads to heap-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is e8a6286542924e628e02749c4f5ac4f91fdae71b. It is recommended to apply a patch to fix this issue.
NVD Severity
unknown
Other trackers
Mailing lists
Exploits
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
vdb-entry https://vuldb.com/?id.303105
signature https://vuldb.com/?ctiid.303105
third-party-advisory https://vuldb.com/?submit.542247
issue-tracking https://github.com/assimp/assimp/issues/6024
issue-tracking https://github.com/assimp/assimp/pull/6051
exploit https://github.com/assimp/assimp/issues/6024#issue-2877382033
patch https://github.com/tellypresence/assimp/commit/e8a6286542924e628e02749c4f5ac4f91fdae71b

Match rules

CPE URI Source package Min version Max version
assimp == 5.4.3 == 5.4.3
cpe:2.3:a:assimp:assimp:5.4.3:*:*:*:*:*:*:* assimp == None == 5.4.3

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
assimp edge-community 5.4.3-r0 Russ Webber <russ@rw.id.au> possibly vulnerable
assimp 3.22-community 5.4.3-r0 Russ Webber <russ@rw.id.au> possibly vulnerable