CVE-2025-3016

Open Asset Import Library Assimp MDL File MDLMaterialLoader.cpp ParseTextureColorData resource consumption

CVSS 5.3 MEDIUMEPSS 0.5%CWE-400 CWE-404

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 5.3EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

31 mar 2025Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::MDLImporter::ParseTextureColorData of the file code/AssetLib/MDL/MDLMaterialLoader.cpp of the component MDL File Handler. The manipulation of the argument mWidth/mHeight leads to resource consumption. The attack can be initiated remotely. Upgrading to version 6.0 is able to address this issue. The name of the patch is 5d2a7482312db2e866439a8c05a07ce1e718bed1. It is recommended to apply a patch to fix this issue.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Produtos afetados

Open Asset Import Library · Assimp

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/assimp/assimp/commit/5d2a7482312db2e866439a8c05a07ce1e718bed1 https://github.com/assimp/assimp/issues/6022 https://github.com/assimp/assimp/pull/6046 https://vuldb.com/?ctiid.302068 https://vuldb.com/?id.302068 https://vuldb.com/?submit.524593