Alta

A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::AC3DImporter::ConvertObjectSection of the file code/AssetLib/AC/ACLoa

Publicada: 25.03.2025
Actualizado: 11.10.2026 12:19

A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::AC3DImporter::ConvertObjectSection of the file code/AssetLib/AC/ACLoader.cpp of the component AC3D File Handler. The manipulation of the argument tmp leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

Plataforma	Paquete	Versiones vulnerables	Corregida en
Python (PyPI)	pyassimp	<= 5.4.3	sin corrección

Referencias

Puntuación CVSS 8.8/10

Vector CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Debilidad (CWE): -
Plataforma: Python (PyPI)
Paquete: pyassimp
Publicada: 25.03.2025
Actualizado: 11.10.2026 12:19

Fuentes y licencias

OSV / GitHub Advisory Database - PYSEC-2025-167 - PyPA Advisory Database; CC BY 4.0

Historial de vulnerabilidades: pyassimp

Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (33) en el archivo

Entradas en total: 33
Primera → última: 09.2024 10.2025
Sin corrección: 33
Explotada en ataques: 0

Distribución por gravedad

Crítica 1
Alta 16
Media 14
Baja 2

Divulgaciones por año

2024: 6
2025: 27
2026: 0

05.10.2025

A weakness has been identified in Open Asset Import Library Assimp 6.0.2. This affects the function Q3DImporter::InternReadFile of the file assimp/code/AssetLib/Q3D/Q3DLoader.cpp. Executing a manipula

Alta · 7.8 CVE-2025-11277 <= 6.0.2 sin corrección
05.10.2025

A vulnerability was identified in Open Asset Import Library Assimp 6.0.2. Affected by this vulnerability is the function ODDLParser::getNextSeparator in the library assimp/contrib/openddlparser/includ

Alta · 7.8 CVE-2025-11275 <= 6.0.2 sin corrección
03.04.2025

A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASE::Parser::ParseLV4MeshBonesVertices of the file code/AssetL

Alta · 7.8 CVE-2025-3159 <= 5.4.3 sin corrección
03.04.2025

A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. Affected by this issue is the function Assimp::LWO::AnimResolver::UpdateAnimRangeSetup of t

Alta · 7.8 CVE-2025-3158 <= 5.4.3 sin corrección
31.03.2025

A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASEImporter::BuildUniqueRepresentation of the file code/AssetLib/ASE/

Alta · 8.8 CVE-2025-3015 <= 5.4.3 sin corrección
25.03.2025

A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::AC3DImporter::ConvertObjectSection of the file code/AssetLib/AC/ACLoa esta entrada

Alta · 8.8 CVE-2025-2756 <= 5.4.3 sin corrección
25.03.2025

A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function AI_MD5_PARSE_STRING_IN_QUOTATION of the file code/AssetLib/MD5/MD5Pa

Alta · 8.8 CVE-2025-2757 <= 5.4.3 sin corrección
25.03.2025

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as critical. Affected is the function SceneCombiner::MergeScenes of the file code/AssetLib/LWS/LWSLoader.cpp

Alta · 8.8 CVE-2025-2753 <= 5.4.3 sin corrección
25.03.2025

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been rated as critical. Affected by this issue is the function Assimp::AC3DImporter::ConvertObjectSection of the file code/A

Alta · 8.8 CVE-2025-2755 <= 5.4.3 sin corrección
25.03.2025

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been declared as critical. Affected by this vulnerability is the function Assimp::AC3DImporter::ConvertObjectSection of the

Alta · 8.8 CVE-2025-2754 <= 5.4.3 sin corrección
25.03.2025

A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This issue affects the function fast_atoreal_move in the library include/assimp/fast_atof.h of the co

Alta · 8.8 CVE-2025-2752 <= 5.4.3 sin corrección
25.03.2025

A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::CSMImporter::InternReadFile of the file code/Ass

Alta · 8.8 CVE-2025-2751 <= 5.4.3 sin corrección
25.03.2025

A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSML

Alta · 8.8 CVE-2025-2750 <= 5.4.3 sin corrección
21.03.2025

A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function CSMImporter::InternReadFile of the file code/AssetLib/CSM/C

Alta · 8.8 CVE-2025-2592 <= 5.4.3 sin corrección
10.03.2025

A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function Assimp::BaseImporter::ConvertToUTF8 of the file BaseImporte

Crítica · 9.8 CVE-2025-2152 <= 5.4.3 sin corrección
10.03.2025

A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::GetNextLine in the library ParsingUtils.h of the component F

Alta · 8.8 CVE-2025-2151 <= 5.4.3 sin corrección
24.10.2024

An issue in assimp v.5.4.3 allows a local attacker to execute arbitrary code via the CallbackToLogRedirector function within the Assimp library.

Alta · 7.8 CVE-2024-48423 todas las versiones sin corrección

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación