CVE-2025-2591 Open Asset Import Library Assimp MDLLoader.cpp InternReadFile_Quake1 divide by zero
A remote attacker can cause a denial of service via divide by zero in Assimp's Quake1 MDL loader, requiring a patch.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-2591?
CVE-2025-2591 is a medium-severity denial of service vulnerability in Open Asset Import Library Assimp, published on 21 Mar 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function MDLImporter::InternReadFile_Quake1 of the file code/AssetLib/MDL/MDLLoader.cpp. The manipulation of the argument skinwidth/skinheight leads to divide by zero. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is identified as ab66a1674fcfac87aaba4c8b900b315ebc3e7dbd. It is recommended to apply a patch to fix this issue.
Which versions are affected by CVE-2025-2591?
1 open source package ship an affected version, including pyassimp. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pyassimp PyPI | All versions to 5.4.3 | None |
Products include Assimp Assimp.
How do I fix CVE-2025-2591?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-2591 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-2591 exists.
Other vulnerabilities in Open Asset Import Library Assimp
Sources
Also known as DEBIAN-CVE-2025-2591, GHSA-6q3p-m444-94qp, PYSEC-2025-160, UBUNTU-CVE-2025-2591.