PYSEC-2025-172

vendorUSosv

Advisory ansehen veröffentlicht 2025-05-26Lizenz: CC-BY-4.0

A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This issue affects the function MDCImporter::ValidateSurfaceHeader of the file assimp/code/AssetLib/MDC/MDCLoader.cpp. The manipulation of the argument pcSurface2 leads to out-of-bounds read. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.

beschreibt (1)

Zugehörige CVEs.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2025-5165US	medium5.5	0.26% (18th)	—	2025-05-26
A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This issue affects the function MDCImporter::ValidateSurfaceHeader of the file as…

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

https://github.com/assimp/assimp/issues/6128REPORT
https://github.com/assimp/assimp/issues/6167REPORT
https://github.com/user-attachments/files/20204942/reproducer.zipEVIDENCE
https://vuldb.com/?ctiid.310253REPORT
https://vuldb.com/?id.310253ADVISORY
https://vuldb.com/?submit.578000ADVISORY

scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan