CVE-2025-5169

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A vulnerability classified as problematic has been found in Open Asset Import Library Assimp 5.4.3. This affects the function MDLImporter::InternReadFile_3DGS_MDL345 of the file assimp/code/AssetLib/MDL/MDLLoader.cpp. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-119 CWE-125

Affected software

No affected versions have been published.

Timeline

Published: May 26, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-516916.1Cross-Site Scripting (XSS) vulnerability found in MarkTwo commit e3a1d3f90cce4ea9c26efcbbf3a1cbfb9dcdb298 (May 2025) allows a remote attacke CVE-2025-51709.8A vulnerability classified as critical was found in llisoft MTA Maita Training System 4.5. This vulnerability affects the function AdminShit CVE-2025-51719.8A vulnerability, which was classified as critical, has been found in llisoft MTA Maita Training System 4.5. This issue affects the function CVE-2025-51729.8A vulnerability, which was classified as critical, was found in Econtrata up to 20250516. Affected is an unknown function of the file /valid CVE-2025-517268.4CyberGhostVPNSetup.exe (Windows installer) is signed using the weak cryptographic hash algorithm SHA-1, which is vulnerable to collision att CVE-2025-51737.8A vulnerability has been found in HumanSignal label-studio-ml-backend up to 9fb7f4aa186612806af2becfb621f6ed8d9fdbaf and classified as probl CVE-2025-517335.5Cross-Site Request Forgery (CSRF) vulnerability in HCL Technologies Ltd. Unica 12.0.0.CVE-2025-517345.4Cross-site scripting (XSS) vulnerability in HCL Technologies Ltd. Unica 12.0.0.CVE-2025-517357.5CSV formula injection vulnerability in HCL Technologies Ltd. Unica 12.0.0.CVE-2025-517366.3File upload vulnerability in HCL Technologies Ltd. Unica 12.0.0.CVE-2025-51747.8A vulnerability was found in erdogant pypickle up to 1.1.5 and classified as problematic. Affected by this issue is the function load of the CVE-2025-517417.5An issue was discovered in Veal98 Echo Open-Source Community System 2.2 thru 2.3 allowing an unauthenticated attacker to cause the server to