CVE-2025-5204

A vulnerability classified as problematic has been found in Open Asset Import Library Assimp 5.4.3. This affects the function MDLImporter::ParseSkinLump_3DGS_MDL7 of the file assimp/code/AssetLib/MDL/MDLMaterialLoader.cpp. The manipulation leads to out-of-bounds read. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.

• CWE-119
• CWE-125
• CWE-125

• https://github.com/assimp/assimp/issues/6128Issue Tracking
• https://github.com/assimp/assimp/issues/6176Exploit, Issue Tracking
• https://github.com/user-attachments/files/20209911/ParseSkinLump-reproducer.zipExploit
• https://vuldb.com/?ctiid.310293Permissions Required, Third Party Advisory, VDB Entry
• https://vuldb.com/?id.310293Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.578013Third Party Advisory, VDB Entry
• https://github.com/assimp/assimp/issues/6176Exploit, Issue Tracking

Published

May 26, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-52026An information disclosure vulnerability exists in the /srvs/…7.5
• CVE-2025-5203A vulnerability was found in Open Asset Import Library Assim…7.8
• CVE-2025-52035A vulnerability in NotesCMS and specifically in the page /in…6.1
• CVE-2025-52036A vulnerability has been found in NotesCMS and classified as…6.1
• CVE-2025-52037A vulnerability has been found in NotesCMS and classified as…6.1
• CVE-2025-52039In Frappe ERPNext 15.57.5, the function get_material_request…8.2
• CVE-2025-52040In Frappe ERPNext 15.57.5, the function get_blanket_orders()…8.2
• CVE-2025-52041In Frappe ERPNext 15.57.5, the function get_stock_balance_fo…8.2
• CVE-2025-52042In Frappe ERPNext 15.57.5, the function get_rfq_containing_s…8.2
• CVE-2025-52043In Frappe ERPNext v15.57.5, the function import_coa() at erp…6.5
• CVE-2025-52044In Frappe ERPNext v15.57.5, the function get_stock_balance()…7.5
• CVE-2025-52046Totolink A3300R V17.0.0cu.596_B20250515 was found to contain…9.8