Open Asset Import Library Assimp CVE-2025-11275

Exploitation requires local system access (AV:L) and execution context with low privileges (PR:L). The attacker must interact with an application that uses Open Asset Import Library Assimp 6.0.2 and specifically attempts to parse OpenDDL format files. The vulnerability is NOT exploitable via remote unauthenticated access; a local user account on the target system is prerequisite. Additionally, the application must actively call the OpenDDLParser functions to process untrusted OpenDDL files. If the target application does not process OpenDDL format files (only other supported 3D formats like FBX, OBJ, glTF), the vulnerability is not triggerable.

The risk assessment reveals a significant disconnect between CVSS scoring and real-world exploitation risk. CVSS 1.9 with AV:L (local), AC:L (low complexity), and PR:L (low privileges required) reflects the attack requirements, but the impact scope is strictly limited: VC:L, VI:L, VA:L (low confidentiality, integrity, availability impact with no scope change). EPSS score of 0.02% (6th percentile) indicates minimal predicted exploitation likelihood in active networks, suggesting this vulnerability is rarely leveraged despite public exploit availability. The publicly available POC elevates awareness but the combination of local-only attack vector, low privilege requirement, and minimal real impact means this is a low-priority issue for most environments. This is a textbook case where high CVSS complexity concepts (buffer overflow) mask low actual severity due to constrained attack surface and privilege requirements. Organizations should prioritize patching higher-CVSS vulnerabilities first; this should be addressed in routine maintenance cycles, not emergency response.

A local user with application privileges on a system running vulnerable Assimp 6.0.2 crafts or provides a malformed OpenDDL format file (.oddl) containing malicious field separator sequences. When the application calls ODDLParser::getNextSeparator to parse this file, the buffer overflow in the separator-parsing logic writes beyond heap boundaries. While the limited impact scope prevents code execution, the corruption could cause application denial of service or minor information disclosure from adjacent heap memory.