Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
76 results · page 1 of 2
Oct 27, 2026Assimp through 6.0.5 contains an integer overflow vulnerability in MD2Importer::ValidateHeader() that allows attackers to bypass frame table bounds checks usingCVE-2026-117608 · Other software · assimp · reported by VulnCheckMedium 6.9
Assimp through 6.0.5 contains an integer overflow vulnerability in MD2Importer::ValidateHeader() that allows attackers to bypass frame table bounds checks using crafted header fields. Attackers can supply a malicious .md2 file whose numFrames and numVertices values wrap the 32-bit size check, causing heap out-of-bounds reads that crash applications or expose adjacent heap memory.
- Product
- assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Open Asset Import Library (assimp) through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D binary mesh importer's OgreBinarySerializer::ReCVE-2026-111129 · Other software · assimp · reported by VulnCheckMedium 6.8
Open Asset Import Library (assimp) through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D binary mesh importer's OgreBinarySerializer::ReadAnimationKeyFrames() handling of unvalidated animation track targets. Attackers can supply a crafted .mesh file with a morph animation track targeting a missing submesh or absent shared geometry to crash the host process.
- Product
- assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D importer that allows attackers to crash applications via unvalidated bone iCVE-2026-111128 · Other software · assimp · reported by VulnCheckMedium 6.8
Assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D importer that allows attackers to crash applications via unvalidated bone indices in OgreStructs.cpp. Attackers can supply a crafted .mesh and .skeleton file referencing a missing bone, causing BoneById() to return null and crash the host process.
- Product
- assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026A vulnerability was detected in Open Asset Import Library Assimp up to 6.0.5.CVE-2026-108573 · Other software · Open Asset Import Library · reported by VulDBMedium 5.1
A vulnerability was detected in Open Asset Import Library Assimp up to 6.0.5. Affected by this vulnerability is the function IOStreamBuffer::getNextBlock of the component PLY File Handler. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2026A security vulnerability has been detected in Open Asset Import Library Assimp up to 6.0.2.CVE-2026-82591 · Other software · Open Asset Import Library · reported by VulDBMedium 4.8
A security vulnerability has been detected in Open Asset Import Library Assimp up to 6.0.2. The impacted element is the function MD5Importer::MakeDataUnique of the file code/AssetLib/MD5/MD5Loader.cpp. The manipulation of the argument iNewIndex leads to heap-based buffer overflow. The attack can only be performed from a local environment. The identifier of the patch is bf9dabb617c46e5133dac65cca6bff177917afcb. Applying a patch is the recommended action to fix this issue.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026A security vulnerability has been detected in Open Asset Import Library Assimp Assimp 17c12da.CVE-2026-19999 · Other software · Open Asset Import Library Assimp · reported by VulDBLow 2.1
A security vulnerability has been detected in Open Asset Import Library Assimp Assimp 17c12da. The affected element is the function Assimp::MDLImporter::ParseBoneTrafoKeys_3DGS_MDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component 3DGS MDL7 Bone Transformation Key Parser. The manipulation of the argument transmatrix_count/pcBoneTransforms leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is 50d767984e78d51b53e2020fdf0967fd624bc377. It is recommended to apply a patch to fix this issue.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2026A vulnerability was detected in Open Asset Import Library Assimp 17c12da.CVE-2026-19970 · Other software · Open Asset Import Library · reported by VulDBLow 2.1
A vulnerability was detected in Open Asset Import Library Assimp 17c12da. This affects the function Assimp::MDLImporter::AddBonesToNodeGraph_3DGS_MDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component Node Parser. The manipulation of the argument bones_num results in heap-based buffer overflow. The attack can be executed remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2026A security vulnerability has been detected in Open Asset Import Library Assimp 17c12da.CVE-2026-19969 · Other software · Open Asset Import Library · reported by VulDBLow 2.1
A security vulnerability has been detected in Open Asset Import Library Assimp 17c12da. The impacted element is the function Assimp::MDLImporter::GenerateOutputMeshes_3DGS_MDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component 3DGS MDL7 Model Output Mesh Generator. The manipulation leads to buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2026A weakness has been identified in Open Asset Import Library Assimp 17c12da.CVE-2026-19968 · Other software · Open Asset Import Library · reported by VulDBLow 2.1
A weakness has been identified in Open Asset Import Library Assimp 17c12da. The affected element is the function Assimp::MDLImporter::ReadFaces_3DGS_MDL7 in the library code/AssetLib/LWO/LWOLoader.h of the component 3DGS MDL7 Model Parser. Executing a manipulation can lead to heap-based buffer overflow. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. This patch is called ee77bb09a42a49843ac85ef64c14d2328b251df1. Applying a patch is advised to resolve this issue.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2026A security flaw has been discovered in Open Asset Import Library Assimp 17c12da.CVE-2026-19967 · Other software · Open Asset Import Library · reported by VulDBLow 2.1
A security flaw has been discovered in Open Asset Import Library Assimp 17c12da. Impacted is the function Assimp::Compression::decompressBlock of the file code/Common/Compression.cpp of the component File Parser. Performing a manipulation results in heap-based buffer overflow. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2026A flaw has been found in Open Asset Import Library Assimp up to 6.0.5.CVE-2026-14610 · Other software · Open Asset Import Library · reported by VulDBLow 1.9
A flaw has been found in Open Asset Import Library Assimp up to 6.0.5. Impacted is the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. This manipulation causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been published and may be used. Patch name: eb84eec580d3f4ba2f0fd87409b7d0744620f11e. Applying a patch is the recommended action to fix this issue.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2026A vulnerability was determined in Open Asset Import Library Assimp up to 6.0.4.CVE-2026-14604 · Other software · Open Asset Import Library · reported by VulDBLow 2.1
A vulnerability was determined in Open Asset Import Library Assimp up to 6.0.4. Affected is the function Assimp::Exporter::ExportToBlob of the file code/AssetLib/Ply/PlyLoader.cpp of the component PLY Model Handler. This manipulation causes double free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2026A security vulnerability has been detected in Open Asset Import Library Assimp up to 5.4.3.CVE-2025-15666 · Other software · Open Asset Import Library · reported by VulDBLow 1.9
A security vulnerability has been detected in Open Asset Import Library Assimp up to 5.4.3. Affected by this vulnerability is the function Assimp::SceneCombiner::Copy of the file code/Common/SceneCombiner.cpp of the component Model File Handler. Such manipulation of the argument width/height leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. This and similar defects are tracked and handled via issue #6128.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026A security vulnerability has been detected in Assimp up to 6.0.4.CVE-2026-10233 · Other software · reported by VulDBLow 1.9
A security vulnerability has been detected in Assimp up to 6.0.4. Affected by this issue is the function HL1MDLLoader::read_sequence_infos of the file HL1MDLLoader.cpp of the component Half-Life 1 MDL Loader. The manipulation of the argument aiString leads to out-of-bounds read. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The project tagged the reported issue as bug.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026A weakness has been identified in Assimp up to 6.0.4.CVE-2026-10232 · Other software · reported by VulDBLow 1.9
A weakness has been identified in Assimp up to 6.0.4. Affected by this vulnerability is the function aiNode::~aiNode of the file scene.cpp of the component ASE File Parser. Executing a manipulation can lead to use after free. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. The project tagged the reported issue as bug.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026A security flaw has been discovered in Assimp up to 6.0.4.CVE-2026-10231 · Other software · reported by VulDBLow 1.9
A security flaw has been discovered in Assimp up to 6.0.4. Affected is the function HL1MDLLoader::extract_anim_value of the file HL1MDLLoader.cpp of the component Half-Life 1 MDL Loader. Performing a manipulation of the argument num.total results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. The project tagged the reported issue as bug.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026A vulnerability was identified in Assimp up to 6.0.4.CVE-2026-10230 · Other software · reported by VulDBLow 1.9
A vulnerability was identified in Assimp up to 6.0.4. This impacts the function Assimp::MDL::HalfLife::HL1MDLLoader::read_animations of the file HL1MDLLoader.cpp of the component Half-Life 1 MDL Loader. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit is publicly available and might be used. The project tagged the reported issue as bug.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026A vulnerability was determined in Assimp up to 6.0.4.CVE-2026-10229 · Other software · reported by VulDBLow 1.9
A vulnerability was determined in Assimp up to 6.0.4. This affects the function HL1MDLLoader::read_meshes of the file HL1MDLLoader.cpp of the component Half-Life 1 MDL Loader. This manipulation causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. The project tagged the reported issue as bug.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2026A vulnerability was determined in Assimp up to 6.0.4.CVE-2026-10201 · Other software · reported by VulDBLow 1.9
A vulnerability was determined in Assimp up to 6.0.4. This vulnerability affects the function FBXExporter::WriteObjects of the file FBXExporter.cpp of the component UV Channel Handler. Executing a manipulation can lead to divide by zero. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Applying a patch is advised to resolve this issue. The project tagged the reported issue as bug.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2026A vulnerability was found in Assimp up to 6.0.4.CVE-2026-10200 · Other software · reported by VulDBLow 1.9
A vulnerability was found in Assimp up to 6.0.4. This affects the function glTFCommon::CopyValue in the library glTFCommon.h of the component 4x4 Matrix Parser. Performing a manipulation results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been made public and could be used. The project tagged the reported issue as bug.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2026A vulnerability has been found in Assimp up to 6.0.4.CVE-2026-10199 · Other software · reported by VulDBLow 1.9
A vulnerability has been found in Assimp up to 6.0.4. Affected by this issue is the function glTF2::LazyDict in the library glTF2Asset.h. Such manipulation of the argument operator[] leads to null pointer dereference. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The name of the patch is d24b85319bd70c65883a2b96613e07e23fb95981. It is best practice to apply a patch to resolve this issue.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2026A flaw has been found in Assimp up to 6.0.4.CVE-2026-10198 · Other software · reported by VulDBLow 1.9
A flaw has been found in Assimp up to 6.0.4. Affected by this vulnerability is the function Assimp::glTFImporter::ImportMeshes of the file glTFImporter.cpp of the component glTFImporter. This manipulation causes null pointer dereference. The attack is restricted to local execution. The exploit has been published and may be used. The project tagged the reported issue as bug.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2026A vulnerability was detected in Assimp up to 6.0.4.CVE-2026-10197 · Other software · reported by VulDBLow 1.9
A vulnerability was detected in Assimp up to 6.0.4. Affected is the function glTF2Importer::ImportEmbeddedTextures in the library code/AssetLib/glTF2/glTF2Importer.cpp of the component TF File Handler. The manipulation results in null pointer dereference. The attack is only possible with local access. The exploit is now public and may be used. It is advisable to implement a patch to correct this issue. The pull request to fix this issue awaits acceptance.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXParser.cpp, ParseVectorDataArray()CVE-2025-70071 · Other software · Red Hat · reported by MITREMedium 5.9
An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXParser.cpp, ParseVectorDataArray()
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comaccess.redhat.com
May 4, 2026An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXConverter.cpp, FBXConverter::ConvertMeshMultiMaterial() componentsCVE-2025-70072 · Other software · reported by MITREMedium 6.5
An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXConverter.cpp, FBXConverter::ConvertMeshMultiMaterial() components
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
May 4, 2026An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXMeshGeometry.cpp, MeshGeometry::MeshGeometry()CVE-2025-70070 · Other software · reported by MITREMedium 6.5
An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXMeshGeometry.cpp, MeshGeometry::MeshGeometry()
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
May 4, 2026An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXConverter.cpp and ConvertMeshMultiMaterial() methodCVE-2025-70069 · Other software · Red Hat · reported by MITREHigh 7.5
An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXConverter.cpp and ConvertMeshMultiMaterial() method
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comaccess.redhat.com
May 4, 2026Buffer Overflow vulnerability exists in Assimp versions up to 6.0.2 in the FBX Importer.CVE-2025-70067 · Other software · reported by MITRECritical 9.8
Buffer Overflow vulnerability exists in Assimp versions up to 6.0.2 in the FBX Importer. The vulnerability occurs in aiMaterial::AddBinaryProperty, where a property key string from a crafted FBX file is copied into a fixed-size heap buffer using strcpy() without runtime length validation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jan 18, 2026A security vulnerability has been detected in Open Asset Import Library Assimp up to 6.0.2.CVE-2025-15538 · Other software · Open Asset Import Library · reported by VulDBLow 1.9
A security vulnerability has been detected in Open Asset Import Library Assimp up to 6.0.2. Affected by this vulnerability is the function Assimp::LWOImporter::FindUVChannels of the file /src/assimp/code/AssetLib/LWO/LWOMaterial.cpp. Such manipulation leads to use after free. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. This and similar defects are tracked and handled via issue #6128.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2025A weakness has been identified in Open Asset Import Library Assimp 6.0.2.CVE-2025-11277 · Other software · Open Asset Import Library · reported by VulDBLow 1.9
A weakness has been identified in Open Asset Import Library Assimp 6.0.2. This affects the function Q3DImporter::InternReadFile of the file assimp/code/AssetLib/Q3D/Q3DLoader.cpp. Executing a manipulation can lead to heap-based buffer overflow. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2025A vulnerability was identified in Open Asset Import Library Assimp 6.0.2.CVE-2025-11275 · Other software · Open Asset Import Library · reported by VulDBLow 1.9
A vulnerability was identified in Open Asset Import Library Assimp 6.0.2. Affected by this vulnerability is the function ODDLParser::getNextSeparator in the library assimp/contrib/openddlparser/include/openddlparser/OpenDDLParserUtils.h. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit is publicly available and might be used.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2025A vulnerability was determined in Open Asset Import Library Assimp 6.0.2.CVE-2025-11274 · Other software · Open Asset Import Library · reported by VulDBLow 1.9
A vulnerability was determined in Open Asset Import Library Assimp 6.0.2. Affected is the function Q3DImporter::InternReadFile of the file assimp/code/AssetLib/Q3D/Q3DLoader.cpp. This manipulation causes allocation of resources. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025A vulnerability classified as critical was found in Open Asset Import Library Assimp up to 5.4.3.CVE-2025-6120 · Other software · Open Asset Import Library · reported by VulDBLow 1.9
A vulnerability classified as critical was found in Open Asset Import Library Assimp up to 5.4.3. Affected by this vulnerability is the function read_meshes in the library assimp/code/AssetLib/MDL/HalfLife/HL1MDLLoader.cpp. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025A vulnerability classified as critical has been found in Open Asset Import Library Assimp up to 5.4.3.CVE-2025-6119 · Other software · Open Asset Import Library · reported by VulDBLow 1.9
A vulnerability classified as critical has been found in Open Asset Import Library Assimp up to 5.4.3. Affected is the function Assimp::BVHLoader::ReadNodeChannels in the library assimp/code/AssetLib/BVH/BVHLoader.cpp. The manipulation of the argument pNode leads to use after free. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025A vulnerability classified as problematic has been found in Open Asset Import Library Assimp 5.4.3.CVE-2025-5204 · Other software · Open Asset Import Library · reported by VulDBMedium 4.8
A vulnerability classified as problematic has been found in Open Asset Import Library Assimp 5.4.3. This affects the function MDLImporter::ParseSkinLump_3DGS_MDL7 of the file assimp/code/AssetLib/MDL/MDLMaterialLoader.cpp. The manipulation leads to out-of-bounds read. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025A vulnerability was found in Open Asset Import Library Assimp 5.4.3.CVE-2025-5203 · Other software · Open Asset Import Library · reported by VulDBMedium 4.8
A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been rated as problematic. Affected by this issue is the function SkipSpaces in the library assimp/include/assimp/ParsingUtils.h. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025A vulnerability was found in Open Asset Import Library Assimp 5.4.3.CVE-2025-5202 · Other software · Open Asset Import Library · reported by VulDBMedium 4.8
A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been declared as problematic. Affected by this vulnerability is the function HL1MDLLoader::validate_header of the file assimp/code/AssetLib/MDL/HalfLife/HL1MDLLoader.cpp. The manipulation leads to out-of-bounds read. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025A vulnerability was found in Open Asset Import Library Assimp 5.4.3.CVE-2025-5201 · Other software · Open Asset Import Library · reported by VulDBMedium 4.8
A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as problematic. Affected is the function LWOImporter::CountVertsAndFacesLWO2 of the file assimp/code/AssetLib/LWO/LWOLoader.cpp. The manipulation leads to out-of-bounds read. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic.CVE-2025-5200 · Other software · Open Asset Import Library · reported by VulDBMedium 4.8
A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This issue affects the function MDLImporter::InternReadFile_Quake1 of the file assimp/code/AssetLib/MDL/MDLLoader.cpp. The manipulation leads to out-of-bounds read. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025A vulnerability classified as problematic has been found in Open Asset Import Library Assimp 5.4.3.CVE-2025-5169 · Other software · Open Asset Import Library · reported by VulDBMedium 4.8
A vulnerability classified as problematic has been found in Open Asset Import Library Assimp 5.4.3. This affects the function MDLImporter::InternReadFile_3DGS_MDL345 of the file assimp/code/AssetLib/MDL/MDLLoader.cpp. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025A vulnerability was found in Open Asset Import Library Assimp 5.4.3.CVE-2025-5168 · Other software · Open Asset Import Library · reported by VulDBMedium 4.8
A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been rated as problematic. Affected by this issue is the function MDLImporter::ImportUVCoordinate_3DGS_MDL345 of the file assimp/code/AssetLib/MDL/MDLLoader.cpp. The manipulation of the argument iIndex leads to out-of-bounds read. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025A vulnerability was found in Open Asset Import Library Assimp 5.4.3.CVE-2025-5167 · Other software · Open Asset Import Library · reported by VulDBMedium 4.8
A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been declared as problematic. Affected by this vulnerability is the function LWOImporter::GetS0 in the library assimp/code/AssetLib/LWO/LWOLoader.h. The manipulation of the argument out leads to out-of-bounds read. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025A vulnerability was found in Open Asset Import Library Assimp 5.4.3.CVE-2025-5166 · Other software · Open Asset Import Library · reported by VulDBMedium 4.8
A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as problematic. Affected is the function MDCImporter::InternReadFile of the file assimp/code/AssetLib/MDC/MDCLoader.cpp of the component MDC File Parser. The manipulation of the argument pcVerts leads to out-of-bounds read. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2025A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic.CVE-2025-5165 · Other software · Open Asset Import Library · reported by VulDBMedium 4.8
A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This issue affects the function MDCImporter::ValidateSurfaceHeader of the file assimp/code/AssetLib/MDC/MDCLoader.cpp. The manipulation of the argument pcSurface2 leads to out-of-bounds read. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2025A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3.CVE-2025-3549 · Other software · Open Asset Import Library · reported by VulDBLow 1.9
A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. Affected is the function Assimp::MD3Importer::ValidateSurfaceHeaderOffsets of the file code/AssetLib/MD3/MD3Loader.cpp of the component File Handler. The manipulation leads to heap-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2025A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp up to 5.4.3.CVE-2025-3548 · Other software · Open Asset Import Library · reported by VulDBLow 1.9
A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp up to 5.4.3. This issue affects the function aiString::Set in the library include/assimp/types.h of the component File Handler. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3.CVE-2025-3196 · Other software · Open Asset Import Library · reported by VulDBLow 1.9
A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. Affected is the function Assimp::MD2Importer::InternReadFile in the library code/AssetLib/MD2/MD2Loader.cpp of the component Malformed File Handler. The manipulation of the argument Name leads to stack-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic.CVE-2025-3160 · Other software · Open Asset Import Library · reported by VulDBMedium 4.8
A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::SceneCombiner::AddNodeHashes of the file code/Common/SceneCombiner.cpp of the component File Handler. The manipulation leads to out-of-bounds read. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as a0993658f40d8e13ff5823990c30b43c82a5daf0. It is recommended to apply a patch to fix this issue.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3.CVE-2025-3159 · Other software · Open Asset Import Library · reported by VulDBMedium 4.8
A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASE::Parser::ParseLV4MeshBonesVertices of the file code/AssetLib/ASE/ASEParser.cpp of the component ASE File Handler. The manipulation leads to heap-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is e8a6286542924e628e02749c4f5ac4f91fdae71b. It is recommended to apply a patch to fix this issue.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3.CVE-2025-3158 · Other software · Open Asset Import Library · reported by VulDBMedium 4.8
A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. Affected by this issue is the function Assimp::LWO::AnimResolver::UpdateAnimRangeSetup of the file code/AssetLib/LWO/LWOAnimation.cpp of the component LWO File Handler. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.