CVE-2025-2591

Name of the Vulnerable Software and Affected Versions Open Asset Import Library Assimp version 5.4.3

Description A vulnerability was found in the Open Asset Import Library Assimp. This issue affects the function MDLImporter::InternReadFile Quake1 of the file code/AssetLib/MDL/MDLLoader.cpp. The manipulation of the arguments skinwidth and skinheight leads to a divide by zero error. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Recommendations To fix this issue, apply the patch identified as ab66a1674fcfac87aaba4c8b900b315ebc3e7dbd. As a temporary workaround, consider restricting the use of the MDLImporter::InternReadFile Quake1 function until a patch is available. Avoid manipulating the skinwidth and skinheight arguments in the affected function to minimize the risk of exploitation.