CVE-2025-2750
Published: 25 March 2025
Description
An adversary may rely upon a user opening a malicious file in order to gain execution.
Security Summary
CVE-2025-2750 is a critical vulnerability in the Open Asset Import Library (Assimp) version 5.4.3, specifically affecting the Assimp::CSMImporter::InternReadFile function in the file code/AssetLib/CSM/CSMLoader.cpp within the CSM File Handler component. The flaw manifests as an out-of-bounds write, associated with CWE-119 and CWE-787.
The vulnerability enables remote exploitation with network accessibility, low attack complexity, no required privileges, but user interaction such as processing a malicious CSM file in an Assimp-dependent application. Attackers can achieve limited impacts on confidentiality, integrity, and availability, per the CVSS 3.1 base score of 6.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).
Advisories and discussions on mitigation are available in GitHub issues at assimp/assimp #6011 and VulDB entries (ctiid.300855, id.300855, submit.517783). The exploit has been publicly disclosed and may be used.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Out-of-bounds write in CSM file parser directly enables code execution via malicious file processing in client applications (T1204.002) and exploitation for client execution (T1203).