Open Asset Import Library Assimp CVE-2025-11275
LOWCVSS VectorNVD
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionNVD
A vulnerability was identified in Open Asset Import Library Assimp 6.0.2. Affected by this vulnerability is the function ODDLParser::getNextSeparator in the library assimp/contrib/openddlparser/include/openddlparser/OpenDDLParserUtils.h. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit is publicly available and might be used.
AnalysisAI
Heap-based buffer overflow in Open Asset Import Library Assimp 6.0.2 affects the ODDLParser::getNextSeparator function in OpenDDLParserUtils.h, allowing local attackers with low privileges to cause limited memory corruption. The vulnerability has a CVSS score of 1.9 with low confidentiality, integrity, and availability impact; however, publicly available exploit code exists and EPSS indicates minimal real-world exploitation probability (0.02% percentile 6%), suggesting this is a low-risk issue in practice despite the buffer overflow designation.
Technical ContextAI
The vulnerability exists in the Open Asset Import Library (Assimp), a widely-used 3D model import library that processes various 3D asset file formats. Specifically, the flaw is in the OpenDDL (Open Data Definition Language) parser component, contained in the openddlparser submodule within assimp/contrib. The ODDLParser::getNextSeparator function in OpenDDLParserUtils.h fails to properly validate buffer boundaries when parsing OpenDDL format files, resulting in a classic heap-based buffer overflow (CWE-119). This is a memory safety issue where input validation lacks sufficient bounds checking, potentially allowing malicious or malformed OpenDDL files to write beyond allocated heap memory boundaries.
RemediationAI
Upgrade Open Asset Import Library Assimp to the latest available version beyond 6.0.2; exact patched version confirmation requires checking the official Assimp GitHub repository releases page. Immediately verify patch availability at github.com/assimp/assimp/releases. If upgrade is not immediately feasible, apply network-level mitigations: restrict file upload functionality that processes OpenDDL format files (.oddl extension) to trusted sources only, disable OpenDDL parser if not required for your application, and validate input files against schema before parsing. Monitor memory sanitizer logs (AddressSanitizer, Valgrind) if running in development environments to detect heap corruption attempts. The trade-off of restricting file uploads may impact functionality; ensure testing confirms no legitimate OpenDDL workflows are blocked.
Share
External POC / Exploit Code
Leaving vuln.today