CVE-2025-5167

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been declared as problematic. Affected by this vulnerability is the function LWOImporter::GetS0 in the library assimp/code/AssetLib/LWO/LWOLoader.h. The manipulation of the argument out leads to out-of-bounds read. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.

• CWE-119
• CWE-125
• CWE-125

• https://github.com/assimp/assimp/issues/6128Issue Tracking
• https://github.com/assimp/assimp/issues/6169Exploit
• https://github.com/user-attachments/files/20208666/reproducer.zipExploit
• https://vuldb.com/?ctiid.310255Permissions Required, VDB Entry
• https://vuldb.com/?id.310255Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.578002Third Party Advisory, VDB Entry
• https://github.com/assimp/assimp/issues/6169Exploit

Published

May 26, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-5166A vulnerability was found in Open Asset Import Library Assim…5.5
• CVE-2025-51660SemCms v5.0 was discovered to contain a SQL injection vulner…5.4
• CVE-2025-51661A path Traversal vulnerability found in FileCodeBox v2.2 and…7.5
• CVE-2025-51662A stored cross-site scripting (XSS) vulnerability is found i…5.4
• CVE-2025-51663A vulnerability found in IPRateLimit implementation of FileC…7.5
• CVE-2025-51667An issue was discovered in simple-admin-core v1.2.0 thru v1.…7
• CVE-2025-51671A SQL injection vulnerability was discovered in the PHPGuruk…5.4
• CVE-2025-51672A time-based blind SQL injection vulnerability was identifie…8
• CVE-2025-51675An issue was discovered in openRISC OR1200 commit 83ac6b. An…7.5
• CVE-2025-51677An issue was discovered in openRISC OR1200 commit 83ac6b. An…9.1
• CVE-2025-51678An issue was discovered in RISC-V PicoRV32 commit 87c89a. A …7.5
• CVE-2025-51679An issue was discovered in openRISC OR1200 commit 83ac6b. A …9.1