Skip to main content

Assimp CVE-2025-70069

| EUVDEUVD-2025-209618 HIGH
Uncontrolled Resource Consumption (CWE-400)
2026-05-04 mitre
Denial Of Service N A
7.5
CVSS 3.1 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE
HIGH
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
May 04, 2026 - 18:23 vuln.today
CVSS changed
May 04, 2026 - 18:22 NVD
7.5 (HIGH)
EUVD ID Assigned
May 04, 2026 - 14:15 euvd
EUVD-2025-209618
Analysis Generated
May 04, 2026 - 14:15 vuln.today
CVE Published
May 04, 2026 - 00:00 nvd
HIGH 7.5

DescriptionCVE.org

An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXConverter.cpp and ConvertMeshMultiMaterial() method

AnalysisAI

Assimp 6.0.2 crashes when processing malformed FBX files due to unchecked resource consumption in the FBX multi-material mesh converter. Remote attackers can trigger denial of service (application crash) via network-delivered malicious 3D model files without authentication, requiring no user interaction beyond normal file processing. EPSS data not available; no evidence of active exploitation (not in CISA KEV). Publicly documented proof-of-concept exists via GitHub Gist, enabling straightforward reproduction.

Technical ContextAI

Assimp (Open Asset Import Library) is a C++ library for importing 3D model files across 50+ formats including FBX (Filmbox), commonly used in game engines and 3D rendering pipelines. The vulnerability resides in FBXConverter.cpp's ConvertMeshMultiMaterial() method, classified as CWE-400 (Uncontrolled Resource Consumption). This indicates improper validation of resource limits when parsing FBX multi-material mesh structures, likely allowing crafted files to trigger excessive memory allocation, infinite loops, or stack exhaustion during mesh conversion operations. CPE data is incomplete (cpe:2.3:a:n/a:n/a), but vendor website confirms Assimp as affected product.

RemediationAI

Upgrade to Assimp version newer than 6.0.2 once a patched release is published - no specific fix version has been announced by the vendor at time of analysis. Monitor the official Assimp GitHub repository (https://github.com/assimp/assimp) for security patches addressing FBXConverter.cpp resource handling. Until patched versions are available, implement these compensating controls with noted trade-offs: (1) Disable FBX format support in Assimp build configuration if business logic permits, eliminating attack surface but restricting supported file types. (2) Deploy file validation layer before Assimp parsing: reject FBX files exceeding size thresholds (e.g., 50MB) or containing abnormal material counts (e.g., >1000 materials per mesh), though this may block legitimate complex models. (3) Run Assimp processing in sandboxed containers with CPU/memory resource limits and automatic restart policies to contain crash impact, adding operational complexity. (4) Apply rate limiting on user-uploaded 3D asset endpoints to prevent DoS amplification, though this doesn't prevent individual instance crashes. Consult GitHub Gist POC (https://gist.github.com/GunP4ng/9080ae7f0470c889a59cc3bfca445223) to understand exact trigger conditions for validation rule design.

More in N A

View all
CVE-2026-31072 CRITICAL POC
9.8 May 19

Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
CVE-2026-36356 CRITICAL POC
9.1 May 05

Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-ST
CVE-2026-31071 CRITICAL POC
9.1 May 19

Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump al
CVE-2025-66391 HIGH POC
8.8 Jun 17

In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write o
CVE-2026-26740 HIGH POC
8.2 Mar 18

Giflib 5.2.2 contains a buffer overflow in the EGifGCBToExtension function that fails to validate allocated memory when

CVE-2025-60464 HIGH POC
7.8 Jun 25

Denial of service in GPAC's MP4Box multimedia tool (versions before 26.02.0) arises from a use-after-free in the gf_sei_
CVE-2026-36355 HIGH POC
7.7 May 05

Arbitrary kernel memory read/write in Realtek rtl819x Jungle SDK Wi-Fi driver allows local unprivileged attackers to acc
CVE-2025-60474 HIGH POC
7.5 Jun 24

Denial of service in GPAC's MP4Box/libgpac media importer (versions before 26.02.0) lets an attacker crash the tool by s
CVE-2026-38639 HIGH POC
7.5 Jun 26

An issue in the parse_month function (/time/strptime.rs) of relibc commit ab6a2e allows attackers to cause a Denial of S
CVE-2026-38641 HIGH POC
7.5 Jun 26

Denial of service in relibc (the Redox OS C standard library) at commit 61f42d allows attackers to crash a process by ge
CVE-2026-38637 HIGH POC
7.5 Jun 25

An issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to cause a Denial of S
CVE-2026-38640 HIGH POC
7.5 Jun 25

Denial of service in relibc (the Redox OS C standard library implementation, commit 61f42d) lets attackers crash a proce

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2026-45498 MEDIUM POC
4.0
CVE-2025-26673 HIGH
7.5
CVE-2015-7978 HIGH
7.5
CVE-2025-27473 HIGH
7.5
CVE-2025-27469 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed

Share

CVE-2025-70069 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy