CVE-2025-3016

NameCVE-2025-3016
DescriptionA vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::MDLImporter::ParseTextureColorData of the file code/AssetLib/MDL/MDLMaterialLoader.cpp of the component MDL File Handler. The manipulation of the argument mWidth/mHeight leads to resource consumption. The attack can be initiated remotely. Upgrading to version 6.0 is able to address this issue. The name of the patch is 5d2a7482312db2e866439a8c05a07ce1e718bed1. It is recommended to apply a patch to fix this issue.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
assimp (PTS)bullseye5.0.1~ds0-2vulnerable
bookworm5.2.5~ds0-1vulnerable
sid, trixie5.4.3+ds-2vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
assimpsource(unstable)(unfixed)

Notes

[bookworm] - assimp <no-dsa> (Minor issue)
https://github.com/assimp/assimp/issues/6022
https://github.com/assimp/assimp/pull/6046
https://github.com/assimp/assimp/commit/5d2a7482312db2e866439a8c05a07ce1e718bed1

Search for package or bug name: Reporting problems