Wysoka

A weakness has been identified in Open Asset Import Library Assimp 6.0.2. This affects the function Q3DImporter::InternReadFile of the file assimp/code/AssetLib/Q3D/Q3DLoader.cpp. Executing a manipula

Ujawniono: 05.10.2025
Aktualizacja: 11.10.2026 12:19

A weakness has been identified in Open Asset Import Library Assimp 6.0.2. This affects the function Q3DImporter::InternReadFile of the file assimp/code/AssetLib/Q3D/Q3DLoader.cpp. Executing a manipulation can lead to heap-based buffer overflow. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks.

Czego dotyczy

Kliknij technologię, aby zobaczyć wszystkie dotyczące jej podatności.

Platforma	Paczka	Podatne wersje	Poprawka w wersji
Python (PyPI)	pyassimp	<= 6.0.2	brak poprawki

Odnośniki

Ocena CVSS 7.8/10

Wektor CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Słabość (CWE): -
Platforma: Python (PyPI)
Paczka: pyassimp
Ujawniono: 05.10.2025
Aktualizacja: 11.10.2026 12:19

Źródła i licencje

OSV / GitHub Advisory Database - PYSEC-2025-157 - PyPA Advisory Database; CC BY 4.0

Historia podatności: pyassimp

Wszystkie opisane podatności tej paczki (Python (PyPI)), od najnowszej. Widać, czy to jednorazowa wpadka, czy paczka, której trzeba pilnować.

Wszystkie (33) w archiwum

Wszystkich wpisów: 33
Pierwsza → ostatnia: 09.2024 10.2025
Bez poprawki: 33
Wykorzystywana w atakach: 0

Rozkład istotności

Krytyczna 1
Wysoka 16
Średnia 14
Niska 2

Ujawnienia w latach

2024: 6
2025: 27
2026: 0

05.10.2025

A weakness has been identified in Open Asset Import Library Assimp 6.0.2. This affects the function Q3DImporter::InternReadFile of the file assimp/code/AssetLib/Q3D/Q3DLoader.cpp. Executing a manipula ten wpis

Wysoka · 7.8 CVE-2025-11277 <= 6.0.2 brak poprawki
05.10.2025

A vulnerability was identified in Open Asset Import Library Assimp 6.0.2. Affected by this vulnerability is the function ODDLParser::getNextSeparator in the library assimp/contrib/openddlparser/includ

Wysoka · 7.8 CVE-2025-11275 <= 6.0.2 brak poprawki
03.04.2025

A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASE::Parser::ParseLV4MeshBonesVertices of the file code/AssetL

Wysoka · 7.8 CVE-2025-3159 <= 5.4.3 brak poprawki
03.04.2025

A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. Affected by this issue is the function Assimp::LWO::AnimResolver::UpdateAnimRangeSetup of t

Wysoka · 7.8 CVE-2025-3158 <= 5.4.3 brak poprawki
31.03.2025

A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASEImporter::BuildUniqueRepresentation of the file code/AssetLib/ASE/

Wysoka · 8.8 CVE-2025-3015 <= 5.4.3 brak poprawki
25.03.2025

A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::AC3DImporter::ConvertObjectSection of the file code/AssetLib/AC/ACLoa

Wysoka · 8.8 CVE-2025-2756 <= 5.4.3 brak poprawki
25.03.2025

A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function AI_MD5_PARSE_STRING_IN_QUOTATION of the file code/AssetLib/MD5/MD5Pa

Wysoka · 8.8 CVE-2025-2757 <= 5.4.3 brak poprawki
25.03.2025

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as critical. Affected is the function SceneCombiner::MergeScenes of the file code/AssetLib/LWS/LWSLoader.cpp

Wysoka · 8.8 CVE-2025-2753 <= 5.4.3 brak poprawki
25.03.2025

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been rated as critical. Affected by this issue is the function Assimp::AC3DImporter::ConvertObjectSection of the file code/A

Wysoka · 8.8 CVE-2025-2755 <= 5.4.3 brak poprawki
25.03.2025

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been declared as critical. Affected by this vulnerability is the function Assimp::AC3DImporter::ConvertObjectSection of the

Wysoka · 8.8 CVE-2025-2754 <= 5.4.3 brak poprawki
25.03.2025

A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This issue affects the function fast_atoreal_move in the library include/assimp/fast_atof.h of the co

Wysoka · 8.8 CVE-2025-2752 <= 5.4.3 brak poprawki
25.03.2025

A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::CSMImporter::InternReadFile of the file code/Ass

Wysoka · 8.8 CVE-2025-2751 <= 5.4.3 brak poprawki
25.03.2025

A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSML

Wysoka · 8.8 CVE-2025-2750 <= 5.4.3 brak poprawki
21.03.2025

A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function CSMImporter::InternReadFile of the file code/AssetLib/CSM/C

Wysoka · 8.8 CVE-2025-2592 <= 5.4.3 brak poprawki
10.03.2025

A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function Assimp::BaseImporter::ConvertToUTF8 of the file BaseImporte

Krytyczna · 9.8 CVE-2025-2152 <= 5.4.3 brak poprawki
10.03.2025

A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::GetNextLine in the library ParsingUtils.h of the component F

Wysoka · 8.8 CVE-2025-2151 <= 5.4.3 brak poprawki
24.10.2024

An issue in assimp v.5.4.3 allows a local attacker to execute arbitrary code via the CallbackToLogRedirector function within the Assimp library.

Wysoka · 7.8 CVE-2024-48423 wszystkie wersje brak poprawki

Dowiedz się, które podatności dotyczą Twojej aplikacji

Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.

Podłącz swoją aplikację