CVE-2025-2151
Published: 10 March 2025
Summary
CVE-2025-2151 is a medium-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Assimp Assimp. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 42.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the CVE by requiring timely identification, reporting, and patching of the stack buffer overflow flaw in Assimp 5.4.3.
Implements memory protection mechanisms like stack canaries, ASLR, and non-executable stacks to prevent exploitation of the stack-based buffer overflow in Assimp::GetNextLine.
Requires validation of file inputs processed by Assimp to restrict malformed data that could trigger the buffer overflow in the file handler component.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in Assimp file parser enables code execution via malicious 3D asset file (T1203 Exploitation for Client Execution); requires user interaction to process the file (T1204.002 Malicious File).
NVD Description
A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::GetNextLine in the library ParsingUtils.h of the component File Handler. The manipulation leads to stack-based buffer overflow. The attack can be…
more
initiated remotely. The exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-2151 is a stack-based buffer overflow vulnerability classified as critical in the Open Asset Import Library (Assimp) version 5.4.3. The issue resides in the Assimp::GetNextLine function within ParsingUtils.h of the File Handler component. It is associated with CWEs-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-121 (Stack-based Buffer Overflow), and CWE-787 (Out-of-bounds Write).
The vulnerability enables remote exploitation through manipulation of input, requiring no privileges (PR:N) but user interaction (UI:R), as indicated by its CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L). An attacker can supply a malicious file that, when processed by an application using the affected Assimp library, triggers the buffer overflow, potentially resulting in limited impacts to confidentiality, integrity, and availability.
Advisories and discussions are available in GitHub issues #6016 and #6026 for Assimp, along with VulDB entries at ctiid.299062 and id.299062. A proof-of-concept exploit crash file has been publicly disclosed at sae-as-me/Crashes/raw/refs/heads/main/assimp/assimp_crash_1, indicating the vulnerability may be usable in attacks.
The exploit has been disclosed to the public, increasing the risk for applications relying on Assimp for 3D asset parsing.
Details
- CWE(s)