CVE-2025-3015 Open Asset Import Library Assimp ASE File ASELoader.cpp BuildUniqueRepresentation out-of-bounds
A remote attacker can trigger an out-of-bounds read in Assimp's ASE file handler, potentially causing denial of service or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-3015?
CVE-2025-3015 is a medium-severity memory corruption vulnerability in Open Asset Import Library Assimp, published on 31 Mar 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASEImporter::BuildUniqueRepresentation of the file code/AssetLib/ASE/ASELoader.cpp of the component ASE File Handler. The manipulation of the argument mIndices leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 6.0 is able to address this issue. The patch is named 7c705fde418d68cca4e8eff56be01b2617b0d6fe. It is recommended to apply a patch to fix this issue.
Which versions are affected by CVE-2025-3015?
1 open source package ship an affected version, including pyassimp. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pyassimp PyPI | All versions to 5.4.3 | None |
Products include Assimp Assimp.
How do I fix CVE-2025-3015?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-3015 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-3015 exists.
Other vulnerabilities in Open Asset Import Library Assimp
Sources
Also known as DEBIAN-CVE-2025-3015, GHSA-j456-qg26-rqx4, PYSEC-2025-261, UBUNTU-CVE-2025-3015.