CVE-2025-5169
Last modified
CVE-2025-5169 is a medium-severity vulnerability rated 5.5/10 on the CVSS scale. A vulnerability classified as problematic has been found in Open Asset Import Library Assimp 5.4.3. This affects the function MDLImporter::InternReadFile_3DGS_MDL345 of the file assimp/code/AssetLib/MDL/MDLLoader.cpp. EPSS estimates a 0.21% chance of exploitation in the next 30 days.
Description
A vulnerability classified as problematic has been found in Open Asset Import Library Assimp 5.4.3. This affects the function MDLImporter::InternReadFile_3DGS_MDL345 of the file assimp/code/AssetLib/MDL/MDLLoader.cpp. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Assimp | Assimp | 5.4.3 |
References
- https://github.com/assimp/assimp/issues/6128Issue Tracking
- https://vuldb.com/?ctiid.310257Permissions Required, VDB Entry
- https://vuldb.com/?id.310257Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.578004Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-5169?
How severe is CVE-2025-5169?
How do I fix CVE-2025-5169?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-51677An issue was discovered in openRISC OR1200 commit 83ac6b. An…9.1
- CVE-2025-51678An issue was discovered in RISC-V PicoRV32 commit 87c89a. A …7.5
- CVE-2025-5168A vulnerability was found in Open Asset Import Library Assim…5.5
- CVE-2025-51682mJobtime 15.7.2 handles authorization on the client side, wh…9.8
- CVE-2025-51683A blind SQL Injection (SQLi) vulnerability in mJobtime v15.7…9.8
- CVE-2025-51684CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Script…6.1
- CVE-2025-51691Cross-Site Scripting (XSS) vulnerability found in MarkTwo co…6.1
- CVE-2025-5170A vulnerability classified as critical was found in llisoft …9.8
- CVE-2025-5171A vulnerability, which was classified as critical, has been …9.8
- CVE-2025-5172A vulnerability, which was classified as critical, was found…9.8
- CVE-2025-51726CyberGhostVPNSetup.exe (Windows installer) is signed using t…8.4
- CVE-2025-5173A vulnerability has been found in HumanSignal label-studio-m…7.8
Are you affected by CVE-2025-5169?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST