Open Asset Import Library Assimp MDL File MDLMaterialLoader.cpp ParseTextureColorData resource consumption

published 2025-03-31 19 mo ago modified 2026-07-13 3 mo ago also PYSEC-2025-262 , EUVD-2025-9053

cvss: 4.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.7%; EPSS 0.7% chance of exploitation in 30 days, percentile 52%
public exploits: 0; none known

A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::MDLImporter::ParseTextureColorData of the file code/AssetLib/MDL/MDLMaterialLoader.cpp of the component MDL File Handler. The manipulation of the argument mWidth/mHeight leads to resource consumption. The attack can be initiated remotely. Upgrading to version 6.0 is able to address this issue. The name of the patch is 5d2a7482312db2e866439a8c05a07ce1e718bed1. It is recommended to apply a patch to fix this issue.

Patch / fix

distros 2 links 2

debian opensuse

assimp Debian 14 6.0.2+ds-1

debian advisories DEBIAN-CVE-2025-3016

assimp Package Hub 15 SP6, openSUSE Leap 15.6 5.3.1-bp156.3.9.1
assimp openSUSE Tumbleweed 5.4.3-5.1

opensuse advisories openSUSE-SU-2025:0113-1 openSUSE-SU-2025:14950-1

github.com/assimp/assimp@5d2a748 commit
github.com/assimp/assimp#6046 pull request

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 19 mo ago (2025-03-31)

Exploit prediction

0.67% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/assimp/assimp/issues/6022 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CNA	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CNA	3.0	4.3	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CNA	2.0	5.0	AV:N/AC:L/Au:N/C:N/I:N/A:P
CNA	4.0	5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
OSV	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
pypi	pyassimp	<=5.4.3	no fix listed

Affected products

Open Asset Import Library Assimp

Classification

Weakness

CWE-400 Uncontrolled Resource Consumption
CWE-404 Improper Resource Shutdown or Release

References

github.com /assimp/assimp/pull/6046
issue-tracking, patch
github.com /assimp/assimp/commit/5d2a7482312db2e866439a8c05a07ce1e718bed1
patch
github.com /assimp/assimp/issues/6022
issue-tracking, exploit, report
vuldb.com /?id.302068
vdb-entry, technical-description, third-party-advisory, advisory
vuldb.com /?ctiid.302068
signature, permissions-required, vdb-entry, report
vuldb.com /?submit.524593
third-party-advisory, vdb-entry, advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary