CVE-2025-5200

Name of the Vulnerable Software and Affected Versions Open Asset Import Library Assimp version 5.4.3

Description A problem was found in the function MDLImporter::InternReadFile Quake1 of the file assimp/code/AssetLib/MDL/MDLLoader.cpp, which leads to out-of-bounds read. The attack can be launched on the local host. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.

Recommendations For Open Asset Import Library Assimp version 5.4.3, as a temporary workaround, consider disabling the MDLImporter::InternReadFile Quake1 function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.