CVE-2025-6119 Open Asset Import Library Assimp BVHLoader.cpp ReadNodeChannels use after free
A use-after-free vulnerability in Assimp's BVHLoader allows local attackers to potentially execute code or cause denial of service via crafted files.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-6119?
CVE-2025-6119 is a medium-severity use after free vulnerability in Open Asset Import Library Assimp, published on 16 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability classified as critical has been found in Open Asset Import Library Assimp up to 5.4.3. Affected is the function Assimp::BVHLoader::ReadNodeChannels in the library assimp/code/AssetLib/BVH/BVHLoader.cpp. The manipulation of the argument pNode leads to use after free. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
Which versions are affected by CVE-2025-6119?
It affects 1 product.
Products include Assimp Assimp.
How do I fix CVE-2025-6119?
No fix published yet.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2025-6119 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-6119 exists.
Other vulnerabilities in Open Asset Import Library Assimp
Sources
Also known as DEBIAN-CVE-2025-6119, GHSA-j5pj-crp5-jh57, JLSEC-2026-196, UBUNTU-CVE-2025-6119.