CVE-2025-3160

low-risk
Published 2025-04-03

A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::SceneCombiner::AddNodeHashes of the file code/Common/SceneCombiner.cpp of the component File Handler. The manipulation leads to out-of-bounds read. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as a0993658f40d8e13ff5823990c30b43c82a5daf0. It is recommended to apply a patch to fix this issue.

Do I need to act?

-
0.09% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
3
CVSS 3.3/10 Low
LOCAL / LOW complexity

Affected Products (1)

Affected Vendors

Assimp

References (8)

Patch https://github.com/assimp/assimp/commit/a0993658f40d8e13ff5823990c30b43c82a5daf0
Exploit https://github.com/assimp/assimp/issues/6025
Exploit https://github.com/assimp/assimp/issues/6025#issue-2877385383
Issue Tracking https://github.com/assimp/assimp/pull/6049
Permissions Required https://vuldb.com/?ctiid.303106
Third Party Advisory https://vuldb.com/?id.303106
Third Party Advisory https://vuldb.com/?submit.542248
Exploit https://github.com/assimp/assimp/issues/6025#issue-2877385383
18
/ 100
low-risk
Severity 13/34 · Low
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal