Cyber Posture

CVE-2025-2750

MediumPublic PoC

Published: 25 March 2025

Published
25 March 2025
Modified
17 July 2025
KEV Added
Patch
CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
EPSS Score 0.0009 24.9th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Description

An adversary may rely upon a user opening a malicious file in order to gain execution.

Security Summary

CVE-2025-2750 is a critical vulnerability in the Open Asset Import Library (Assimp) version 5.4.3, specifically affecting the Assimp::CSMImporter::InternReadFile function in the file code/AssetLib/CSM/CSMLoader.cpp within the CSM File Handler component. The flaw manifests as an out-of-bounds write, associated with CWE-119 and CWE-787.

The vulnerability enables remote exploitation with network accessibility, low attack complexity, no required privileges, but user interaction such as processing a malicious CSM file in an Assimp-dependent application. Attackers can achieve limited impacts on confidentiality, integrity, and availability, per the CVSS 3.1 base score of 6.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).

Advisories and discussions on mitigation are available in GitHub issues at assimp/assimp #6011 and VulDB entries (ctiid.300855, id.300855, submit.517783). The exploit has been publicly disclosed and may be used.

Details

CWE(s)
CWE-119CWE-787

Affected Products

assimp
assimp
5.4.3

MITRE ATT&CK Enterprise Techniques

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
T1204.002 Malicious File Execution
An adversary may rely upon a user opening a malicious file in order to gain execution.
Why these techniques?

Out-of-bounds write in CSM file parser directly enables code execution via malicious file processing in client applications (T1204.002) and exploitation for client execution (T1203).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References