CVE-2025-2592 Open Asset Import Library Assimp CSMLoader.cpp InternReadFile heap-based overflow
A heap-based buffer overflow in Assimp's CSMLoader allows remote attackers to execute arbitrary code or cause denial of service via crafted files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-2592?
CVE-2025-2592 is a medium-severity memory corruption vulnerability in Open Asset Import Library Assimp, published on 21 Mar 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named 2690e354da0c681db000cfd892a55226788f2743. It is recommended to apply a patch to fix this issue.
Which versions are affected by CVE-2025-2592?
1 open source package ship an affected version, including pyassimp. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pyassimp PyPI | All versions to 5.4.3 | None |
Linux distribution packages (2)
doomsday SUSE:Package Hub 15 SP6 | All versions | 2.3.1-bp156.4.3.1 |
doomsday openSUSE:Leap 15.6 | All versions | 2.3.1-bp156.4.3.1 |
Products include Assimp Assimp.
How do I fix CVE-2025-2592?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-2592 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-2592 exists.
Other vulnerabilities in Open Asset Import Library Assimp
Sources
Also known as DEBIAN-CVE-2025-2592, GHSA-gq4x-2qp9-2gvw, PYSEC-2025-260, UBUNTU-CVE-2025-2592, openSUSE-SU-2025:0117-1.