CVE-2025-3196

Name of the Vulnerable Software and Affected Versions Open Asset Import Library Assimp version 5.4.3

Description A critical vulnerability was found in Open Asset Import Library Assimp. The function Assimp::MD2Importer::InternReadFile in the library code/AssetLib/MD2/MD2Loader.cpp of the component Malformed File Handler is affected. The manipulation of the argument Name leads to a stack-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.

Recommendations As a temporary workaround, consider disabling the Assimp::MD2Importer::InternReadFile function until a patch is available. To resolve the issue, upgrade the affected component to a newer version. At the moment, there is no information about a newer version that contains a fix for this vulnerability.