CVE-2025-2754— Open Asset Import Library Assimp AC3D File ACLoader.cpp ConvertObjectSection heap-based overflow
Quick assessment
Affected
Open Asset Import Library Assimp
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Open Asset Import Library（assimp）是Open Asset Import Library开源的一个库。 Open Asset Import Library（assimp） 5.4.3版本存在安全漏洞，该漏洞源于对参数it的错误操作会导致堆缓冲区溢出。
Possible ATT&CK Techniques 2 AI
T1203 · Exploitation for Client Execution T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-2754
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Open Asset Import Library Assimp AC3D File ACLoader.cpp ConvertObjectSection heap-based overflow
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been declared as critical. Affected by this vulnerability is the function Assimp::AC3DImporter::ConvertObjectSection of the file code/AssetLib/AC/ACLoader.cpp of the component AC3D File Handler. The manipulation of the argument it leads to heap-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
堆缓冲区溢出
Source: CVE Program / CVE List V5
Vulnerability Title
Open Asset Import Library（assimp） 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Open Asset Import Library（assimp）是Open Asset Import Library开源的一个库。 Open Asset Import Library（assimp） 5.4.3版本存在安全漏洞，该漏洞源于对参数it的错误操作会导致堆缓冲区溢出。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Open Asset Import Library | Assimp | 5.4.3 | - |
|
II. Public POCs for CVE-2025-2754
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-2754
请登录查看更多情报信息。
Vendor Advisories for CVE-2025-2754 (3)
-
CVE-2025-2754 Open Asset Import Library Assimp AC3D File ACLoader.cpp ConvertObjectSection heap-based overflow (Issue 6015) signature permissions-required
-
Submit #517788: Open Asset Import Library Assimp >=5.4.3 Heap-based Buffer Overflow third-party-advisory
-
CVE-2025-2754 Open Asset Import Library Assimp AC3D File ACLoader.cpp ConvertObjectSection heap-based overflow (Issue 6015) vdb-entry technical-description
Proof of Concept for CVE-2025-2754 (1)
Other References for CVE-2025-2754 (1)
Same Patch Batch · Open Asset Import Library · 2025-03-25 · 8 CVEs total
| CVE-2025-2750 | 6.3 MEDIUM | Open Asset Import Library Assimp CSM File CSMLoader.cpp InternReadFile out-of-bounds write |
| CVE-2025-2753 | 6.3 MEDIUM | Open Asset Import Library Assimp LWS File LWSLoader.cpp MergeScenes out-of-bounds |
| CVE-2025-2755 | 6.3 MEDIUM | Open Asset Import Library Assimp AC3D File ACLoader.cpp ConvertObjectSection out-of-bounds |
| CVE-2025-2756 | 6.3 MEDIUM | Open Asset Import Library Assimp AC3D File ACLoader.cpp ConvertObjectSection heap-based ov |
| CVE-2025-2757 | 6.3 MEDIUM | Open Asset Import Library Assimp MD5 File MD5Parser.cpp AI_MD5_PARSE_STRING_IN_QUOTATION h |
| CVE-2025-2751 | 4.3 MEDIUM | Open Asset Import Library Assimp CSM File CSMLoader.cpp InternReadFile out-of-bounds |
| CVE-2025-2752 | 4.3 MEDIUM | Open Asset Import Library Assimp CSM File fast_atof.h fast_atoreal_move out-of-bounds |
IV. Related Vulnerabilities
Same product: Assimp
-
CVE-2026-19999
Open Asset Import Library Assimp 3DGS MDL7 Bone Transformati -
CVE-2026-19970
Open Asset Import Library Assimp Node MDLLoader.cpp AddBones -
CVE-2026-19969
Open Asset Import Library Assimp 3DGS MDL7 Model Output Mesh -
CVE-2026-19968
Open Asset Import Library Assimp 3DGS MDL7 Model LWOLoader.h -
CVE-2026-19967
Open Asset Import Library Assimp File Compression.cpp decomp
Same vendor: Open Asset Import Library
-
CVE-2026-19970
Open Asset Import Library Assimp Node MDLLoader.cpp AddBones -
CVE-2026-19969
Open Asset Import Library Assimp 3DGS MDL7 Model Output Mesh -
CVE-2026-19968
Open Asset Import Library Assimp 3DGS MDL7 Model LWOLoader.h -
CVE-2026-19967
Open Asset Import Library Assimp File Compression.cpp decomp -
CVE-2026-14610
Open Asset Import Library Assimp CSM File CSMLoader.cpp Inte
Same weakness: CWE-122
-
CVE-2026-78156
Open5GS S6a Authentication-Information-Request hss-s6a-path. -
CVE-2026-62381
luci-lib-px5g 2040-bit Certificate Signing Heap Buffer Overf -
CVE-2026-50538
libvncclient Tight decoder has an attacker-controlled heap o -
CVE-2026-55893
Capstone SH disassembler `set_reg_n` heap buffer overflow vi -
CVE-2026-70654
libvips: A well-crafted PPM image processed via a custom sou
V. Comments for CVE-2025-2754
No comments yet