Skip to main content

Assimp CVE-2025-70067

| EUVDEUVD-2025-209616 CRITICAL
Heap-based Buffer Overflow (CWE-122)
2026-05-04 mitre
Buffer Overflow Heap Overflow N A
Critical
Disputed · 9.8 Vendor: mitre
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (mitre) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SUSE
CRITICAL
qualitative
Red Hat
5.6 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: mitre

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
May 05, 2026 - 16:22 vuln.today
CVSS changed
May 05, 2026 - 16:22 NVD
9.8 (CRITICAL)
EUVD ID Assigned
May 04, 2026 - 14:15 euvd
EUVD-2025-209616
CVE Published
May 04, 2026 - 00:00 nvd
N/A

DescriptionCVE.org

Buffer Overflow vulnerability exists in Assimp versions up to 6.0.2 in the FBX Importer. The vulnerability occurs in aiMaterial::AddBinaryProperty, where a property key string from a crafted FBX file is copied into a fixed-size heap buffer using strcpy() without runtime length validation

AnalysisAI

Heap buffer overflow in Assimp's FBX importer allows remote code execution when processing malicious FBX files. The vulnerability affects Assimp versions up to 6.0.2 through unsafe strcpy() operations in aiMaterial::AddBinaryProperty, enabling attackers to achieve arbitrary code execution with high CVSS severity (9.8). A proof-of-concept exploit is publicly available via GitHub Gist, though EPSS indicates only 0.02% exploitation probability and no CISA KEV listing exists, suggesting limited active exploitation despite the theoretical severity.

Technical ContextAI

Assimp (Open Asset Import Library) is a widely-used C++ library for importing various 3D model formats including FBX (Filmbox). The vulnerability stems from CWE-122 (heap-based buffer overflow) in the FBX import pipeline, specifically within aiMaterial::AddBinaryProperty function. When parsing FBX files, property key strings are copied into fixed-size heap buffers using strcpy() - a classic unsafe C string function that performs no bounds checking. An attacker-crafted FBX file with oversized property key strings triggers the overflow, allowing heap memory corruption. This represents a fundamental memory safety issue common in legacy C/C++ codebases handling untrusted file formats, where parser code predates modern memory-safe practices.

RemediationAI

Upgrade to Assimp version 6.0.3 or later once available, monitoring the official GitHub repository at github.com/assimp/assimp for patched releases addressing this buffer overflow. As of analysis time, no officially tagged fix version is confirmed in available data sources. Until patches are deployed, implement defense-in-depth controls: disable FBX import functionality if not business-critical (Assimp supports 40+ formats, consider restricting to safer alternatives like glTF); validate and sanitize FBX files before processing using file format validators; process untrusted FBX files in sandboxed environments with limited privileges (containers, VMs, capability-restricted processes); implement file size limits and timeout controls on import operations to constrain exploitation window; enable memory protection mechanisms like ASLR, DEP, and heap integrity checks in the runtime environment. Note that disabling FBX support may break workflows dependent on Autodesk ecosystem file exchange. For server-side implementations, consider moving FBX processing to isolated worker services with no network access to limit post-exploitation lateral movement. Monitor vendor advisory channels and apply patches immediately upon release given public POC availability.

More in N A

View all
CVE-2024-51092 CRITICAL POC
9.1 May 08

LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
CVE-2025-15684 MEDIUM POC
5.5 Aug 12

Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
CVE-2024-45257 HIGH POC
7.3 May 08

A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
CVE-2025-15687 LOW POC
2.1 Aug 12

Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
CVE-2025-15686 LOW POC
2.1 Aug 12

Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
CVE-2025-67888 HIGH POC
7.3 May 08

Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root

CVE-2024-53326 HIGH POC
7.3 May 08

LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
CVE-2026-38360 CRITICAL POC
9.8 May 08

Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
CVE-2026-30623 CRITICAL POC
9.8 Jul 15

Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
CVE-2026-67917 CRITICAL POC
9.8 Aug 17

SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
CVE-2026-75337 CRITICAL POC
9.8 Aug 27

Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
CVE-2026-31072 CRITICAL POC
9.8 May 19

Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2025-25249 CRITICAL POC
9.8
CVE-2026-85880 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8
CVE-2023-23376 HIGH
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2025-70067 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy