Media

A heap-buffer-overflow vulnerability was discovered in the SkipSpacesAndLineEnd function in Assimp v5.4.3. This issue occurs when processing certain malformed MD5 model files, leading to an out-of-bou

Publicada: 21.11.2024
Actualizado: 11.10.2026 12:19

A heap-buffer-overflow vulnerability was discovered in the SkipSpacesAndLineEnd function in Assimp v5.4.3. This issue occurs when processing certain malformed MD5 model files, leading to an out-of-bounds read and potential application crash.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

Plataforma	Paquete	Versiones vulnerables	Corregida en
Python (PyPI)	pyassimp	<= 5.4.3	sin corrección

Referencias

https://github.com/assimp/assimp/issues/5860

Puntuación CVSS 6.2/10

Vector CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Debilidad (CWE): -
Plataforma: Python (PyPI)
Paquete: pyassimp
Publicada: 21.11.2024
Actualizado: 11.10.2026 12:19

Fuentes y licencias

OSV / GitHub Advisory Database - PYSEC-2024-295 - PyPA Advisory Database; CC BY 4.0

Historial de vulnerabilidades: pyassimp

Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (33) en el archivo

Entradas en total: 33
Primera → última: 09.2024 10.2025
Sin corrección: 33
Explotada en ataques: 0

Distribución por gravedad

Crítica 1
Alta 16
Media 14
Baja 2

Divulgaciones por año

2024: 6
2025: 27
2026: 0

05.10.2025

A weakness has been identified in Open Asset Import Library Assimp 6.0.2. This affects the function Q3DImporter::InternReadFile of the file assimp/code/AssetLib/Q3D/Q3DLoader.cpp. Executing a manipula

Alta · 7.8 CVE-2025-11277 <= 6.0.2 sin corrección
05.10.2025

A vulnerability was identified in Open Asset Import Library Assimp 6.0.2. Affected by this vulnerability is the function ODDLParser::getNextSeparator in the library assimp/contrib/openddlparser/includ

Alta · 7.8 CVE-2025-11275 <= 6.0.2 sin corrección
03.04.2025

A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASE::Parser::ParseLV4MeshBonesVertices of the file code/AssetL

Alta · 7.8 CVE-2025-3159 <= 5.4.3 sin corrección
03.04.2025

A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. Affected by this issue is the function Assimp::LWO::AnimResolver::UpdateAnimRangeSetup of t

Alta · 7.8 CVE-2025-3158 <= 5.4.3 sin corrección
31.03.2025

A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASEImporter::BuildUniqueRepresentation of the file code/AssetLib/ASE/

Alta · 8.8 CVE-2025-3015 <= 5.4.3 sin corrección
25.03.2025

A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::AC3DImporter::ConvertObjectSection of the file code/AssetLib/AC/ACLoa

Alta · 8.8 CVE-2025-2756 <= 5.4.3 sin corrección
25.03.2025

A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function AI_MD5_PARSE_STRING_IN_QUOTATION of the file code/AssetLib/MD5/MD5Pa

Alta · 8.8 CVE-2025-2757 <= 5.4.3 sin corrección
25.03.2025

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as critical. Affected is the function SceneCombiner::MergeScenes of the file code/AssetLib/LWS/LWSLoader.cpp

Alta · 8.8 CVE-2025-2753 <= 5.4.3 sin corrección
25.03.2025

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been rated as critical. Affected by this issue is the function Assimp::AC3DImporter::ConvertObjectSection of the file code/A

Alta · 8.8 CVE-2025-2755 <= 5.4.3 sin corrección
25.03.2025

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been declared as critical. Affected by this vulnerability is the function Assimp::AC3DImporter::ConvertObjectSection of the

Alta · 8.8 CVE-2025-2754 <= 5.4.3 sin corrección
25.03.2025

A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This issue affects the function fast_atoreal_move in the library include/assimp/fast_atof.h of the co

Alta · 8.8 CVE-2025-2752 <= 5.4.3 sin corrección
25.03.2025

A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::CSMImporter::InternReadFile of the file code/Ass

Alta · 8.8 CVE-2025-2751 <= 5.4.3 sin corrección
25.03.2025

A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSML

Alta · 8.8 CVE-2025-2750 <= 5.4.3 sin corrección
21.03.2025

A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function CSMImporter::InternReadFile of the file code/AssetLib/CSM/C

Alta · 8.8 CVE-2025-2592 <= 5.4.3 sin corrección
10.03.2025

A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function Assimp::BaseImporter::ConvertToUTF8 of the file BaseImporte

Crítica · 9.8 CVE-2025-2152 <= 5.4.3 sin corrección
10.03.2025

A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::GetNextLine in the library ParsingUtils.h of the component F

Alta · 8.8 CVE-2025-2151 <= 5.4.3 sin corrección
21.11.2024

A heap-buffer-overflow vulnerability was discovered in the SkipSpacesAndLineEnd function in Assimp v5.4.3. This issue occurs when processing certain malformed MD5 model files, leading to an out-of-bou esta entrada

Media · 6.2 CVE-2024-53425 <= 5.4.3 sin corrección
24.10.2024

An issue in assimp v.5.4.3 allows a local attacker to execute arbitrary code via the CallbackToLogRedirector function within the Assimp library.

Alta · 7.8 CVE-2024-48423 todas las versiones sin corrección

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación