CVE-2025-3015
Last modified
CVE-2025-3015 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASEImporter::BuildUniqueRepresentation of the file code/AssetLib/ASE/ASELoader.cpp of the component ASE File Handler. EPSS estimates a 0.44% chance of exploitation in the next 30 days.
Description
A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASEImporter::BuildUniqueRepresentation of the file code/AssetLib/ASE/ASELoader.cpp of the component ASE File Handler. The manipulation of the argument mIndices leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 6.0 is able to address this issue. The patch is named 7c705fde418d68cca4e8eff56be01b2617b0d6fe. It is recommended to apply a patch to fix this issue.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Assimp | Assimp | 5.4.3 |
References
- https://github.com/assimp/assimp/issues/6021Exploit, Issue Tracking
- https://github.com/assimp/assimp/issues/6021#issue-2877378829Exploit, Issue Tracking
- https://github.com/assimp/assimp/pull/6045Issue Tracking, Patch
- https://vuldb.com/?ctiid.302067Permissions Required, VDB Entry
- https://vuldb.com/?id.302067Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.524589Third Party Advisory, VDB Entry
- https://github.com/assimp/assimp/issues/6021Exploit, Issue Tracking
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-3015?
How severe is CVE-2025-3015?
How do I fix CVE-2025-3015?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-30143Rule 3000216 (before version 2) in Akamai App & API Protecto…5.4
- CVE-2025-30144fast-jwt provides fast JSON Web Token (JWT) implementation. …6.5
- CVE-2025-30145GeoServer is an open source server that allows users to shar…7.5
- CVE-2025-30147Besu Native contains scripts and tooling that is used to bui…8.7
- CVE-2025-30148Silverstripe Framework is a PHP framework which powers the S…5.4
- CVE-2025-30149OpenEMR is a free and open source electronic health records …4.6
- CVE-2025-30150Shopware 6 is an open commerce platform based on Symfony Fra…5.3
- CVE-2025-30151Shopware is an open commerce platform. It's possible to pass…7.5
- CVE-2025-30152The Syliud PayPal Plugin is the Sylius Core Team’s plugin fo…6.5
- CVE-2025-30153kin-openapi is a Go project for handling OpenAPI files. Prio…7.5
- CVE-2025-30154reviewdog/action-setup is a GitHub action that installs revi…8.6
- CVE-2025-30155Tuleap is an Open Source Suite to improve management of soft…4.3
Are you affected by CVE-2025-3015?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST