EUVD-2025-18386Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector, low privileges required, low impact to all three pillars.
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
8DescriptionCVE.org
A vulnerability classified as critical was found in Open Asset Import Library Assimp up to 5.4.3. Affected by this vulnerability is the function read_meshes in the library assimp/code/AssetLib/MDL/HalfLife/HL1MDLLoader.cpp. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
AnalysisAI
Heap-based buffer overflow in Assimp up to 5.4.3 allows local attackers with low privileges to execute arbitrary code or cause denial of service by enticing a user to load a crafted Half-Life MDL file. A public proof-of-concept exploit exists, but no official patch has been released despite the vendor acknowledging the issue. The EPSS score is low (0.05%), indicating limited exploitation activity currently, but the availability of public exploit code raises the risk for environments where untrusted MDL files are processed.
Technical ContextAI
Assimp (Open Asset Import Library) is a widely used library for importing various 3D model formats into applications. The vulnerability resides in the Half-Life MDL loader, specifically in the read_meshes function within HL1MDLLoader.cpp. The CWE-119 classification (buffer overflow) indicates improper bounds checking when parsing meshes from a crafted MDL file, leading to a heap buffer overflow. CPE data shows all versions up to and including 5.4.3 are affected. The Half-Life MDL format is legacy but still used in some game mods and tools.
RemediationAI
No official patched version has been released as of the time of analysis; the vendor plans to address the issue in a future update by collecting fuzzer bugs into a main issue. Until a fix is available, the recommended workaround is to disable the Half-Life MDL importer or avoid processing untrusted MDL files entirely. For applications using Assimp, this can be done by not registering the MDL importer or by sanitizing input. Alternatively, restrict local access to users who do not need to load 3D models from untrusted sources. Monitor the vendor’s GitHub repository for a fix commit. Rebuilding Assimp with ASLR and stack canaries can mitigate impact but does not prevent exploitation.
An issue in assimp v.5.4.3 allows a local attacker to execute arbitrary code via the CallbackToLogRedirector function wi
Open Asset Import Library (assimp) commit 3c253ca was discovered to contain a segmentation violation via the component A
A heap-buffer-overflow vulnerability was discovered in the SkipSpacesAndLineEnd function in Assimp v5.4.3. Rated medium
A segmentation fault (SEGV) was detected in the SortByPTypeProcess::Execute function in the Assimp library during fuzz t
A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode function within the
A heap-buffer-overflow vulnerability has been identified in the OpenDDLParser::parseStructure function within the Assimp
A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. Rated medium severity (CV
A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic.h of the component CSM
A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. Rated medium severity (
A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3.cpp. Rated m
A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. Rated medium severity (CVSS
A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. Rated medium severity (
Same weakness CWE-119 – Buffer Overflow
View allSame technique Buffer Overflow
View allVendor StatusVendor
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| xenial | needs-triage | - |
| bionic | needs-triage | - |
| focal | needs-triage | - |
| jammy | needs-triage | - |
| noble | needs-triage | - |
| upstream | needs-triage | - |
| plucky | ignored | end of life, was needs-triage |
| oracular | ignored | end of life, was needs-triage |
| questing | needs-triage | - |
Debian
Bug #1107936| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | vulnerable | 5.0.1~ds0-2 | - |
| bookworm | vulnerable | 5.2.5~ds0-1 | - |
| trixie | vulnerable | 5.4.3+ds-2 | - |
| forky, sid | vulnerable | 6.0.4+ds-1 | - |
| (unstable) | fixed | (unfixed) | - |
SUSE
Severity: Medium| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Fixed |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today