CVE-2025-5201

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as problematic. Affected is the function LWOImporter::CountVertsAndFacesLWO2 of the file assimp/code/AssetLib/LWO/LWOLoader.cpp. The manipulation leads to out-of-bounds read. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.

• CWE-119
• CWE-125
• CWE-125

• https://github.com/assimp/assimp/issues/6128Issue Tracking
• https://github.com/assimp/assimp/issues/6173Exploit, Issue Tracking
• https://github.com/user-attachments/files/20209125/line-832-reproducer.zipExploit
• https://vuldb.com/?ctiid.310290Permissions Required, Third Party Advisory, VDB Entry
• https://vuldb.com/?id.310290Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.578006Third Party Advisory, VDB Entry
• https://github.com/assimp/assimp/issues/6174Exploit, Issue Tracking

Published

May 26, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-51986An issue was discovered in the demo/LINUXTCP implementation …7.5
• CVE-2025-51989HTML injection vulnerability in the registration interface i…7
• CVE-2025-5199In Canonical Multipass up to and including version 1.15.1 on…7.8
• CVE-2025-51990XWiki through version 17.3.0 is affected by multiple stored …4.8
• CVE-2025-51991XWiki through version 17.3.0 is vulnerable to Server-Side Te…8.8
• CVE-2025-5200A vulnerability was found in Open Asset Import Library Assim…7.8
• CVE-2025-5202A vulnerability was found in Open Asset Import Library Assim…7.8
• CVE-2025-52021A SQL Injection vulnerability exists in the edit_product.php…9.8
• CVE-2025-52022A vulnerability in the PHP backend of gemsloyalty.aptsys.com…5.3
• CVE-2025-52023A vulnerability in the PHP backend of gemscms.aptsys.com.sg …5.3
• CVE-2025-52024A vulnerability exists in the Aptsys POS Platform Web Servic…9.4
• CVE-2025-52025An SQL Injection vulnerability exists in the GetServiceByRes…9.4