CVE-2025-5202

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been declared as problematic. Affected by this vulnerability is the function HL1MDLLoader::validate_header of the file assimp/code/AssetLib/MDL/HalfLife/HL1MDLLoader.cpp. The manipulation leads to out-of-bounds read. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.

• CWE-119
• CWE-125
• CWE-125

• https://github.com/assimp/assimp/issues/6128Issue Tracking
• https://github.com/assimp/assimp/issues/6174Exploit, Issue Tracking
• https://github.com/user-attachments/files/20209236/reproducer.zipExploit
• https://vuldb.com/?ctiid.310291Permissions Required, Third Party Advisory, VDB Entry
• https://vuldb.com/?id.310291Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.578007Third Party Advisory, VDB Entry
• https://github.com/assimp/assimp/issues/6174Exploit, Issue Tracking

Published

May 26, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-51989HTML injection vulnerability in the registration interface i…7
• CVE-2025-5199In Canonical Multipass up to and including version 1.15.1 on…7.8
• CVE-2025-51990XWiki through version 17.3.0 is affected by multiple stored …4.8
• CVE-2025-51991XWiki through version 17.3.0 is vulnerable to Server-Side Te…8.8
• CVE-2025-5200A vulnerability was found in Open Asset Import Library Assim…7.8
• CVE-2025-5201A vulnerability was found in Open Asset Import Library Assim…7.8
• CVE-2025-52021A SQL Injection vulnerability exists in the edit_product.php…9.8
• CVE-2025-52022A vulnerability in the PHP backend of gemsloyalty.aptsys.com…5.3
• CVE-2025-52023A vulnerability in the PHP backend of gemscms.aptsys.com.sg …5.3
• CVE-2025-52024A vulnerability exists in the Aptsys POS Platform Web Servic…9.4
• CVE-2025-52025An SQL Injection vulnerability exists in the GetServiceByRes…9.4
• CVE-2025-52026An information disclosure vulnerability exists in the /srvs/…7.5