CVE-2025-3196 — MEDIUM (5.3)

Vulnerability Description

A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. Affected is the function Assimp::MD2Importer::InternReadFile in the library code/AssetLib/MD2/MD2Loader.cpp of the component Malformed File Handler. The manipulation of the argument Name leads to stack-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.

CVSS Score

5.3

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

LOW

Availability

LOW

Affected Products

Vendor	Product	Versions
Assimp	Assimp	5.4.3

Related Weaknesses (CWE)

CWE-121 CWE-119 CWE-787

References

https://github.com/assimp/assimp/issues/6069ExploitIssue Tracking
https://github.com/assimp/assimp/issues/6069#issuecomment-2763273425ExploitIssue Tracking
https://github.com/assimp/assimp/milestone/11Product
https://vuldb.com/?ctiid.303150Permissions RequiredThird Party AdvisoryVDB Entry
https://vuldb.com/?id.303150Third Party AdvisoryVDB Entry
https://vuldb.com/?submit.545368Third Party AdvisoryVDB Entry
https://github.com/assimp/assimp/issues/6069ExploitIssue Tracking

FAQ

What is CVE-2025-3196?

CVE-2025-3196 is a vulnerability with a CVSS score of 5.3 (MEDIUM). A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. Affected is the function Assimp::MD2Importer::InternReadFile in the library code/AssetLib/MD2/MD...

How severe is CVE-2025-3196?

CVE-2025-3196 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2025-3196?

Check the references section above for vendor advisories and patch information. Affected products include: Assimp Assimp.