CVE-2025-3016 Open Asset Import Library Assimp MDL File MDLMaterialLoader.cpp ParseTextureColorData resource consumption
Remote attackers can cause resource exhaustion in Assimp by crafting malicious MDL files, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-3016?
CVE-2025-3016 is a medium-severity denial of service vulnerability in Open Asset Import Library Assimp, published on 31 Mar 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::MDLImporter::ParseTextureColorData of the file code/AssetLib/MDL/MDLMaterialLoader.cpp of the component MDL File Handler. The manipulation of the argument mWidth/mHeight leads to resource consumption. The attack can be initiated remotely. Upgrading to version 6.0 is able to address this issue. The name of the patch is 5d2a7482312db2e866439a8c05a07ce1e718bed1. It is recommended to apply a patch to fix this issue.
Which versions are affected by CVE-2025-3016?
1 open source package ship an affected version, including pyassimp. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pyassimp PyPI | All versions to 5.4.3 | None |
Products include Assimp Assimp.
How do I fix CVE-2025-3016?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-3016 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-3016 exists.
Other vulnerabilities in Open Asset Import Library Assimp
Sources
Also known as DEBIAN-CVE-2025-3016, GHSA-mpgp-fqh7-8mm2, PYSEC-2025-262, UBUNTU-CVE-2025-3016.