CVE-2025-3015

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASEImporter::BuildUniqueRepresentation of the file code/AssetLib/ASE/ASELoader.cpp of the component ASE File Handler. The manipulation of the argument mIndices leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 6.0 is able to address this issue. The patch is named 7c705fde418d68cca4e8eff56be01b2617b0d6fe. It is recommended to apply a patch to fix this issue.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-125

Affected software

Vendor	Product	Versions
Open Asset Import Library	Assimp	5.4.3

References

https://github.com/assimp/assimp/commit/7c705fde418d68cca4e8eff56be01b2617b0d6fePatch
https://github.com/assimp/assimp/issues/6021Exploit, Issue Tracking
https://github.com/assimp/assimp/issues/6021#issue-2877378829Exploit, Issue Tracking
https://github.com/assimp/assimp/pull/6045Issue Tracking, Patch
https://vuldb.com/?ctiid.302067Permissions Required, VDB Entry
https://vuldb.com/?id.302067Third Party Advisory, VDB Entry
https://vuldb.com/?submit.524589Third Party Advisory, VDB Entry
https://github.com/assimp/assimp/issues/6021Exploit, Issue Tracking

Timeline

Published: Mar 31, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-301505.3Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Through the store-api it is possible as a attacker to check if a CVE-2025-301517.5Shopware is an open commerce platform. It's possible to pass long passwords that leads to Denial Of Service via forms in Storefront forms or CVE-2025-301526.5The Syliud PayPal Plugin is the Sylius Core Team’s plugin for the PayPal Commerce Platform. Prior to 1.6.2, 1.7.2, and 2.0.2, a discovered v CVE-2025-301537.5kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if th CVE-2025-301548.6reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 a CVE-2025-301554.3Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap does not enforce read permissions on CVE-2025-301568.9Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the C CVE-2025-301577.5Envoy is a cloud-native high-performance edge/middle/service proxy. Prior to 1.33.1, 1.32.4, 1.31.6, and 1.30.10, Envoy's ext_proc HTTP filt CVE-2025-301587.1NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, the forum allows users to p CVE-2025-301599.1Kirby is an open-source content management system. A vulnerability in versions prior to 3.9.8.3, 3.10.1.2, and 4.7.1 affects all Kirby sites CVE-2025-30166.5A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assim CVE-2025-301607.5Redlib is an alternative private front-end to Reddit. A vulnerability has been identified in Redlib where an attacker can cause a denial-of-