Hoch

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as critical. Affected is the function SceneCombiner::MergeScenes of the file code/AssetLib/LWS/LWSLoader.cpp

Veröffentlicht: 25.03.2025
Aktualisiert: 11.10.2026 12:19

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as critical. Affected is the function SceneCombiner::MergeScenes of the file code/AssetLib/LWS/LWSLoader.cpp of the component LWS File Handler. The manipulation leads to out-of-bounds read. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Betroffene Software

Klicken Sie auf eine Technologie, um alle zugehörigen Schwachstellen anzuzeigen.

Plattform	Paket	Anfällige Versionen	Behoben in
Python (PyPI)	pyassimp	<= 5.4.3	keine Korrektur

Verweise

CVSS-Wert 8.8/10

CVSS-Vektor: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Schwäche (CWE): -
Plattform: Python (PyPI)
Paket: pyassimp
Veröffentlicht: 25.03.2025
Aktualisiert: 11.10.2026 12:19

Quellen und Lizenzen

OSV / GitHub Advisory Database - PYSEC-2025-164 - PyPA Advisory Database; CC BY 4.0

Schwachstellenhistorie: pyassimp

Alle veröffentlichten Schwachstellen dieses Pakets (Python (PyPI)), neueste zuerst. Zeigt, ob es ein einmaliger Ausrutscher ist oder ein Paket, das man im Auge behalten muss.

Alle (33) im Archiv

Einträge insgesamt: 33
Erste → letzte: 09.2024 10.2025
Ohne Fix: 33
In Angriffen ausgenutzt: 0

Verteilung nach Schweregrad

Kritisch 1
Hoch 16
Mittel 14
Niedrig 2

Veröffentlichungen pro Jahr

2024: 6
2025: 27
2026: 0

05.10.2025

A weakness has been identified in Open Asset Import Library Assimp 6.0.2. This affects the function Q3DImporter::InternReadFile of the file assimp/code/AssetLib/Q3D/Q3DLoader.cpp. Executing a manipula

Hoch · 7.8 CVE-2025-11277 <= 6.0.2 keine Korrektur
05.10.2025

A vulnerability was identified in Open Asset Import Library Assimp 6.0.2. Affected by this vulnerability is the function ODDLParser::getNextSeparator in the library assimp/contrib/openddlparser/includ

Hoch · 7.8 CVE-2025-11275 <= 6.0.2 keine Korrektur
03.04.2025

A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASE::Parser::ParseLV4MeshBonesVertices of the file code/AssetL

Hoch · 7.8 CVE-2025-3159 <= 5.4.3 keine Korrektur
03.04.2025

A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. Affected by this issue is the function Assimp::LWO::AnimResolver::UpdateAnimRangeSetup of t

Hoch · 7.8 CVE-2025-3158 <= 5.4.3 keine Korrektur
31.03.2025

A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASEImporter::BuildUniqueRepresentation of the file code/AssetLib/ASE/

Hoch · 8.8 CVE-2025-3015 <= 5.4.3 keine Korrektur
25.03.2025

A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::AC3DImporter::ConvertObjectSection of the file code/AssetLib/AC/ACLoa

Hoch · 8.8 CVE-2025-2756 <= 5.4.3 keine Korrektur
25.03.2025

A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function AI_MD5_PARSE_STRING_IN_QUOTATION of the file code/AssetLib/MD5/MD5Pa

Hoch · 8.8 CVE-2025-2757 <= 5.4.3 keine Korrektur
25.03.2025

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as critical. Affected is the function SceneCombiner::MergeScenes of the file code/AssetLib/LWS/LWSLoader.cpp dieser Eintrag

Hoch · 8.8 CVE-2025-2753 <= 5.4.3 keine Korrektur
25.03.2025

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been rated as critical. Affected by this issue is the function Assimp::AC3DImporter::ConvertObjectSection of the file code/A

Hoch · 8.8 CVE-2025-2755 <= 5.4.3 keine Korrektur
25.03.2025

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been declared as critical. Affected by this vulnerability is the function Assimp::AC3DImporter::ConvertObjectSection of the

Hoch · 8.8 CVE-2025-2754 <= 5.4.3 keine Korrektur
25.03.2025

A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This issue affects the function fast_atoreal_move in the library include/assimp/fast_atof.h of the co

Hoch · 8.8 CVE-2025-2752 <= 5.4.3 keine Korrektur
25.03.2025

A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::CSMImporter::InternReadFile of the file code/Ass

Hoch · 8.8 CVE-2025-2751 <= 5.4.3 keine Korrektur
25.03.2025

A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSML

Hoch · 8.8 CVE-2025-2750 <= 5.4.3 keine Korrektur
21.03.2025

A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function CSMImporter::InternReadFile of the file code/AssetLib/CSM/C

Hoch · 8.8 CVE-2025-2592 <= 5.4.3 keine Korrektur
10.03.2025

A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function Assimp::BaseImporter::ConvertToUTF8 of the file BaseImporte

Kritisch · 9.8 CVE-2025-2152 <= 5.4.3 keine Korrektur
10.03.2025

A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::GetNextLine in the library ParsingUtils.h of the component F

Hoch · 8.8 CVE-2025-2151 <= 5.4.3 keine Korrektur
24.10.2024

An issue in assimp v.5.4.3 allows a local attacker to execute arbitrary code via the CallbackToLogRedirector function within the Assimp library.

Hoch · 7.8 CVE-2024-48423 alle Versionen keine Korrektur

Erkennen Sie Schwachstellen in Ihrer Anwendung

Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.

Anwendung verbinden