PYSEC-2025-172

vendorUSosv

view advisory published 2025-05-26Licence: CC-BY-4.0

A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This issue affects the function MDCImporter::ValidateSurfaceHeader of the file assimp/code/AssetLib/MDC/MDCLoader.cpp. The manipulation of the argument pcSurface2 leads to out-of-bounds read. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-5165US	medium5.5	0.26% (18th)	—	2025-05-26
A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This issue affects the function MDCImporter::ValidateSurfaceHeader of the file as…

references

External citations — patches, advisories, analysis.

https://github.com/assimp/assimp/issues/6128REPORT
https://github.com/assimp/assimp/issues/6167REPORT
https://github.com/user-attachments/files/20204942/reproducer.zipEVIDENCE
https://vuldb.com/?ctiid.310253REPORT
https://vuldb.com/?id.310253ADVISORY
https://vuldb.com/?submit.578000ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan