CVE-2025-3548

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp up to 5.4.3. This issue affects the function aiString::Set in the library include/assimp/types.h of the component File Handler. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-119 CWE-122

Affected software

Vendor	Product	Versions
Open Asset Import Library	Assimp	5.4.0; 5.4.1; 5.4.2; 5.4.3

References

https://github.com/assimp/assimp/issues/6068Exploit, Issue Tracking
https://github.com/assimp/assimp/pull/6073Issue Tracking, Patch
https://github.com/user-attachments/files/19580584/aiString_Set-hbo.zipExploit
https://vuldb.com/?ctiid.304589Permissions Required, VDB Entry
https://vuldb.com/?id.304589Third Party Advisory, VDB Entry
https://vuldb.com/?submit.546413Third Party Advisory, VDB Entry

Timeline

Published: Apr 14, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-35493.3A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. Affected is the function Assimp::MD3 CVE-2025-35504.3A vulnerability has been found in wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System 1.0 and classified as problematic. Affected by th CVE-2025-35539.8A vulnerability was found in phpshe 1.8. It has been declared as critical. This vulnerability affects the function pe_delete of the file /ad CVE-2025-35546.1A vulnerability was found in phpshe 1.8. It has been rated as problematic. This issue affects some unknown processing of the file api.php?mo CVE-2025-35558.1A vulnerability classified as problematic has been found in ScriptAndTools eCommerce-website-in-PHP 3.0. Affected is an unknown function of CVE-2025-35568.1A vulnerability classified as problematic was found in ScriptAndTools eCommerce-website-in-PHP 3.0. Affected by this vulnerability is an unk CVE-2025-35574.3A vulnerability, which was classified as problematic, has been found in ScriptAndTools eCommerce-website-in-PHP 3.0. Affected by this issue CVE-2025-35589.8A vulnerability, which was classified as critical, was found in ghostxbh uzy-ssm-mall 1.0.0. This affects an unknown part of the file /mall/CVE-2025-35599.8A vulnerability has been found in ghostxbh uzy-ssm-mall 1.0.0 and classified as critical. This vulnerability affects the function ForeProduc CVE-2025-35605.4A vulnerability was found in ghostxbh uzy-ssm-mall 1.0.0 and classified as problematic. This issue affects some unknown processing of the fi CVE-2025-35616.5A vulnerability was found in ghostxbh uzy-ssm-mall 1.0.0. It has been classified as problematic. Affected is an unknown function. The manipu CVE-2025-35624.3A vulnerability was found in Yonyou YonBIP MA2.7. It has been declared as problematic. Affected by this vulnerability is the function FileIn