CVE-2025-5168

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been rated as problematic. Affected by this issue is the function MDLImporter::ImportUVCoordinate_3DGS_MDL345 of the file assimp/code/AssetLib/MDL/MDLLoader.cpp. The manipulation of the argument iIndex leads to out-of-bounds read. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.

• CWE-119
• CWE-125
• CWE-125

• https://github.com/assimp/assimp/issues/6128Issue Tracking
• https://github.com/assimp/assimp/issues/6170Exploit
• https://github.com/user-attachments/files/20208878/reproducer.zipExploit
• https://vuldb.com/?ctiid.310256Permissions Required, VDB Entry
• https://vuldb.com/?id.310256Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.578003Third Party Advisory, VDB Entry
• https://github.com/assimp/assimp/issues/6170Exploit

Published

May 26, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-51671A SQL injection vulnerability was discovered in the PHPGuruk…5.4
• CVE-2025-51672A time-based blind SQL injection vulnerability was identifie…8
• CVE-2025-51675An issue was discovered in openRISC OR1200 commit 83ac6b. An…7.5
• CVE-2025-51677An issue was discovered in openRISC OR1200 commit 83ac6b. An…9.1
• CVE-2025-51678An issue was discovered in RISC-V PicoRV32 commit 87c89a. A …7.5
• CVE-2025-51679An issue was discovered in openRISC OR1200 commit 83ac6b. A …9.1
• CVE-2025-51682mJobtime 15.7.2 handles authorization on the client side, wh…9.8
• CVE-2025-51683A blind SQL Injection (SQLi) vulnerability in mJobtime v15.7…9.8
• CVE-2025-51684CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Script…6.1
• CVE-2025-5169A vulnerability classified as problematic has been found in …5.5
• CVE-2025-51691Cross-Site Scripting (XSS) vulnerability found in MarkTwo co…6.1
• CVE-2025-5170A vulnerability classified as critical was found in llisoft …9.8