Medium

A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function MDLImporter::InternReadFile_Quake1 of the file code/AssetLib/MDL/

Disclosed: 21.03.2025
Updated: 11.10.2026 12:19

A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function MDLImporter::InternReadFile_Quake1 of the file code/AssetLib/MDL/MDLLoader.cpp. The manipulation of the argument skinwidth/skinheight leads to divide by zero. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is identified as ab66a1674fcfac87aaba4c8b900b315ebc3e7dbd. It is recommended to apply a patch to fix this issue.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
Python (PyPI)	pyassimp	<= 5.4.3	no fix

References

CVSS score 5.5/10

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness (CWE): -
Platform: Python (PyPI)
Package: pyassimp
Disclosed: 21.03.2025
Updated: 11.10.2026 12:19

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2025-160 - PyPA Advisory Database; CC BY 4.0

Vulnerability history: pyassimp

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (33) in the archive

Total entries: 33
First → latest: 09.2024 10.2025
Without a fix: 33
Exploited in attacks: 0

Severity breakdown

Critical 1
High 16
Medium 14
Low 2

Disclosures per year

2024: 6
2025: 27
2026: 0

05.10.2025

A weakness has been identified in Open Asset Import Library Assimp 6.0.2. This affects the function Q3DImporter::InternReadFile of the file assimp/code/AssetLib/Q3D/Q3DLoader.cpp. Executing a manipula

High · 7.8 CVE-2025-11277 <= 6.0.2 no fix
05.10.2025

A vulnerability was identified in Open Asset Import Library Assimp 6.0.2. Affected by this vulnerability is the function ODDLParser::getNextSeparator in the library assimp/contrib/openddlparser/includ

High · 7.8 CVE-2025-11275 <= 6.0.2 no fix
03.04.2025

A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASE::Parser::ParseLV4MeshBonesVertices of the file code/AssetL

High · 7.8 CVE-2025-3159 <= 5.4.3 no fix
03.04.2025

A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. Affected by this issue is the function Assimp::LWO::AnimResolver::UpdateAnimRangeSetup of t

High · 7.8 CVE-2025-3158 <= 5.4.3 no fix
31.03.2025

A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASEImporter::BuildUniqueRepresentation of the file code/AssetLib/ASE/

High · 8.8 CVE-2025-3015 <= 5.4.3 no fix
25.03.2025

A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::AC3DImporter::ConvertObjectSection of the file code/AssetLib/AC/ACLoa

High · 8.8 CVE-2025-2756 <= 5.4.3 no fix
25.03.2025

A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function AI_MD5_PARSE_STRING_IN_QUOTATION of the file code/AssetLib/MD5/MD5Pa

High · 8.8 CVE-2025-2757 <= 5.4.3 no fix
25.03.2025

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as critical. Affected is the function SceneCombiner::MergeScenes of the file code/AssetLib/LWS/LWSLoader.cpp

High · 8.8 CVE-2025-2753 <= 5.4.3 no fix
25.03.2025

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been rated as critical. Affected by this issue is the function Assimp::AC3DImporter::ConvertObjectSection of the file code/A

High · 8.8 CVE-2025-2755 <= 5.4.3 no fix
25.03.2025

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been declared as critical. Affected by this vulnerability is the function Assimp::AC3DImporter::ConvertObjectSection of the

High · 8.8 CVE-2025-2754 <= 5.4.3 no fix
25.03.2025

A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This issue affects the function fast_atoreal_move in the library include/assimp/fast_atof.h of the co

High · 8.8 CVE-2025-2752 <= 5.4.3 no fix
25.03.2025

A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::CSMImporter::InternReadFile of the file code/Ass

High · 8.8 CVE-2025-2751 <= 5.4.3 no fix
25.03.2025

A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSML

High · 8.8 CVE-2025-2750 <= 5.4.3 no fix
21.03.2025

A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function CSMImporter::InternReadFile of the file code/AssetLib/CSM/C

High · 8.8 CVE-2025-2592 <= 5.4.3 no fix
21.03.2025

A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function MDLImporter::InternReadFile_Quake1 of the file code/AssetLib/MDL/ this entry

Medium · 5.5 CVE-2025-2591 <= 5.4.3 no fix
10.03.2025

A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function Assimp::BaseImporter::ConvertToUTF8 of the file BaseImporte

Critical · 9.8 CVE-2025-2152 <= 5.4.3 no fix
10.03.2025

A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::GetNextLine in the library ParsingUtils.h of the component F

High · 8.8 CVE-2025-2151 <= 5.4.3 no fix
24.10.2024

An issue in assimp v.5.4.3 allows a local attacker to execute arbitrary code via the CallbackToLogRedirector function within the Assimp library.

High · 7.8 CVE-2024-48423 all versions no fix

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application