CVE-2025-2757

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function AI_MD5_PARSE_STRING_IN_QUOTATION of the file code/AssetLib/MD5/MD5Parser.cpp of the component MD5 File Handler. The manipulation of the argument data leads to heap-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-122

Affected software

Vendor	Product	Versions
Open Asset Import Library	Assimp	5.4.3

References

https://github.com/assimp/assimp/issues/6019Exploit, Issue Tracking
https://github.com/assimp/assimp/issues/6019#issue-2877376386Exploit, Issue Tracking
https://vuldb.com/?ctiid.300862Permissions Required, VDB Entry
https://vuldb.com/?id.300862Third Party Advisory, VDB Entry
https://vuldb.com/?submit.517817Third Party Advisory, VDB Entry

Timeline

Published: Mar 25, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-275714.3Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to check the "Allow Users to View Archived Channels" configura CVE-2025-275724.1Exposure of sensitive information during transient execution for some TDX within Ring 0: Hypervisor may allow an information disclosure. Aut CVE-2025-275743.6Cross-site scripting vulnerability exists in the USB storage file-sharing function of HGW-BL1500HM Ver 002.002.003 and earlier. If this vuln CVE-2025-275755.3An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID.CVE-2025-275762.9Uncontrolled resource consumption for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow CVE-2025-275777.0in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in tcb through race condition.CVE-2025-275787.5Pixmeo OsiriX MD is vulnerable to a use after free scenario, which could allow an attacker to upload a crafted DICOM file and cause memory c CVE-2025-275795.4In Bitaxe ESP-Miner before 2.5.0 with AxeOS, one can use an /api/system CSRF attack to update the payout address (aka stratumUser) for a Bit CVE-2025-275807.5NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 generates predictable tokens (that depend on username, ti CVE-2025-275814.3NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 allows users who lack the InET role to access the InET mo CVE-2025-275827.6The Secure Password extension in One Identity Password Manager before 5.14.4 allows local privilege escalation. The issue arises from a flaw CVE-2025-275839.1Incorrect access control in the component /rest/staffResource/findAllUsersAcrossOrg of Serosoft Solutions Pvt Ltd Academia Student Informati