Open Asset Import Library Assimp CVE-2025-11277

Exploitation requires local file system access and the ability to place or control a malicious Q3D file that an authenticated user or application will process via Assimp's Q3D importer. The vulnerable function Q3DImporter::InternReadFile must be invoked, which occurs when an application explicitly imports or loads a Q3D format model. The condition is NOT present in default configurations that do not use Assimp or do not support Q3D format parsing. If an application uses Assimp but restricts input to trusted, pre-validated Q3D files or disables Q3D format support, exploitation is prevented. The vulnerability does not require network access, elevated privileges beyond standard user account level (PR:L), or user interaction beyond opening/processing a file (UI:N), but all three prerequisites-local access, Q3D import capability, and file processing by Assimp-must converge for exploitation.

Multiple risk signals conflict, requiring careful interpretation. The CVSS 1.9 score and V:L/VI:L/VA:L impact ratings suggest minimal real-world harm - the buffer overflow does not grant remote code execution, privilege escalation, or availability disruption under the CVSS 4.0 scope model. The EPSS 0.03% (percentile 8%) corroborates this, indicating very low exploitation probability in the wild. However, the presence of publicly available exploit code (POC) elevates concern for targeted attacks against specific users or applications processing untrusted Q3D files. Critically, this vulnerability requires local access (AV:L) and authenticated user privileges (PR:L), sharply limiting the threat surface compared to network-exploitable flaws. The attack complexity is low (AC:L) and requires no user interaction (UI:N), suggesting that once a user with local access processes a malicious Q3D file, exploitation is straightforward. Risk assessment conclusion: This is a low-severity, low-probability exploit suitable for inclusion in patch management workflows but not requiring emergency response. Defenders should prioritize patching if Assimp is integrated into applications that accept untrusted Q3D files from local users, but the realistic attack scenario remains narrow.

A local user with shell or application access places a maliciously crafted Q3D file in a shared directory or uploads it to an application processing 3D models. When an authenticated user or application running with standard privileges opens or imports the Q3D file through Assimp, the buffer overflow corrupts heap memory, potentially crashing the process or enabling limited code execution within the application's privilege context. The low CVSS impact ratings suggest that even successful exploitation yields minimal security breach - memory corruption may cause denial of service or information disclosure rather than direct privilege escalation.