CVE-2025-5168

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been rated as problematic. Affected by this issue is the function MDLImporter::ImportUVCoordinate_3DGS_MDL345 of the file assimp/code/AssetLib/MDL/MDLLoader.cpp. The manipulation of the argument iIndex leads to out-of-bounds read. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-119 CWE-125

Affected software

Vendor	Product	Versions
Open Asset Import Library	Assimp	5.4.3

References

https://github.com/assimp/assimp/issues/6128Issue Tracking
https://github.com/assimp/assimp/issues/6170Exploit
https://github.com/user-attachments/files/20208878/reproducer.zipExploit
https://vuldb.com/?ctiid.310256Permissions Required, VDB Entry
https://vuldb.com/?id.310256Third Party Advisory, VDB Entry
https://vuldb.com/?submit.578003Third Party Advisory, VDB Entry
https://github.com/assimp/assimp/issues/6170Exploit

Timeline

Published: May 26, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-516829.8mJobtime 15.7.2 handles authorization on the client side, which allows an attacker to modify the client-side code and gain access to adminis CVE-2025-516839.8A blind SQL Injection (SQLi) vulnerability in mJobtime v15.7.2 allows unauthenticated attackers to execute arbitrary SQL statements via a cr CVE-2025-516846.1CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting (XSS). The application does not sanitize untrusted data received via window.CVE-2025-51695.5A vulnerability classified as problematic has been found in Open Asset Import Library Assimp 5.4.3. This affects the function MDLImporter::I CVE-2025-516916.1Cross-Site Scripting (XSS) vulnerability found in MarkTwo commit e3a1d3f90cce4ea9c26efcbbf3a1cbfb9dcdb298 (May 2025) allows a remote attacke CVE-2025-51709.8A vulnerability classified as critical was found in llisoft MTA Maita Training System 4.5. This vulnerability affects the function AdminShit CVE-2025-51719.8A vulnerability, which was classified as critical, has been found in llisoft MTA Maita Training System 4.5. This issue affects the function CVE-2025-51729.8A vulnerability, which was classified as critical, was found in Econtrata up to 20250516. Affected is an unknown function of the file /valid CVE-2025-517268.4CyberGhostVPNSetup.exe (Windows installer) is signed using the weak cryptographic hash algorithm SHA-1, which is vulnerable to collision att CVE-2025-51737.8A vulnerability has been found in HumanSignal label-studio-ml-backend up to 9fb7f4aa186612806af2becfb621f6ed8d9fdbaf and classified as probl CVE-2025-517335.5Cross-Site Request Forgery (CSRF) vulnerability in HCL Technologies Ltd. Unica 12.0.0.CVE-2025-517345.4Cross-site scripting (XSS) vulnerability in HCL Technologies Ltd. Unica 12.0.0.