CVE-2025-6120

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical was found in Open Asset Import Library Assimp up to 5.4.3. Affected by this vulnerability is the function read_meshes in the library assimp/code/AssetLib/MDL/HalfLife/HL1MDLLoader.cpp. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-119 CWE-122

Affected software

Vendor	Product	Versions
Open Asset Import Library	Assimp	5.4.0; 5.4.1; 5.4.2; 5.4.3

References

https://github.com/assimp/assimp/issues/6220Exploit, Issue Tracking, Third Party Advisory
https://github.com/assimp/assimp/issues/6220#issuecomment-2945018579Issue Tracking
https://github.com/user-attachments/files/20605340/read_meshes_reproduce.tar.gzExploit
https://vuldb.com/?ctiid.312589Permissions Required
https://vuldb.com/?id.312589Third Party Advisory, VDB Entry
https://vuldb.com/?submit.591235Third Party Advisory, VDB Entry

Timeline

Published: Jun 16, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-61219.8A vulnerability, which was classified as critical, has been found in D-Link DIR-632 FW103B08. Affected by this issue is the function get_pur CVE-2025-61228.8A vulnerability, which was classified as critical, was found in code-projects Restaurant Order System 1.0. This affects an unknown part of t CVE-2025-612207.5The incomplete verification mechanism in the AutoBizLine com.mysecondline.app 1.2.91 allows attackers to log in as other users and gain unau CVE-2025-612246.5Cross Site Scripting vulnerability in DokuWiki 2025-05-14a 'Librarian'[56.1] allows a remote attacker to execute arbitrary code via the q pa CVE-2025-612287.8An issue in Shirt Pocket SuperDuper! V.3.10 and before allows a local attacker to execute arbitrary code via the software update mechanism CVE-2025-612297.8An issue in Shirt Pocket's SuperDuper! 3.10 and earlier allow a local attacker to modify the default task template to execute an arbitrary p CVE-2025-61239.8A vulnerability has been found in code-projects Restaurant Order System 1.0 and classified as critical. This vulnerability affects unknown c CVE-2025-612347.5Incorrect access control on Dataphone A920 v2025.07.161103 exposes a service on port 8888 by default on the local network without authentica CVE-2025-612359.1An issue was discovered in Dataphone A920 v2025.07.161103. A custom packet based on public documentation can be crafted, where some fields c CVE-2025-61249.8A vulnerability was found in code-projects Restaurant Order System 1.0 and classified as critical. This issue affects some unknown processin CVE-2025-612469.8indieka900 online-shopping-system-php 1.0 is vulnerable to SQL Injection in master/review_action.php via the proId parameter.CVE-2025-612478.2indieka900 online-shopping-system-php 1.0 is vulnerable to SQL Injection in the password parameter of login.php.