Cyber Posture

CVE-2025-2752

MediumPublic PoC

Published: 25 March 2025

Published
25 March 2025
Modified
17 July 2025
KEV Added
Patch
CVSS Score 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
EPSS Score 0.0010 26.3th percentile
Risk Priority 9 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-2752 is a medium-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Assimp Assimp. Its CVSS base score is 4.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 26.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Malicious File (T1204.002) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mitigates the out-of-bounds read vulnerability by requiring timely remediation through patching or upgrading the vulnerable Assimp library.

prevent

Implements memory protection mechanisms that prevent exploitation of out-of-bounds reads in the fast_atoreal_move function, limiting potential denial-of-service impacts.

prevent

Requires validation of inputs to the Assimp CSM File Handler to block malformed files that trigger the out-of-bounds read, though comprehensive validation may not catch all edge cases.

MITRE ATT&CK Enterprise TechniquesAI

T1204.002 Malicious File Execution
An adversary may rely upon a user opening a malicious file in order to gain execution.
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

Vulnerability triggered by malicious file input to Assimp library causes application crash (limited DoS); directly maps to user execution via malicious file and endpoint DoS via application exploitation.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This issue affects the function fast_atoreal_move in the library include/assimp/fast_atof.h of the component CSM File Handler. The manipulation leads to out-of-bounds read. The attack may…

more

be initiated remotely. The exploit has been disclosed to the public and may be used.

Deeper analysisAI

CVE-2025-2752 is a vulnerability found in the Open Asset Import Library (Assimp) version 5.4.3, classified as problematic. It affects the fast_atoreal_move function located in the library's include/assimp/fast_atof.h file within the CSM File Handler component. The flaw enables an out-of-bounds read through manipulation of input, as mapped to CWE-119 and CWE-125.

The vulnerability carries a CVSS v3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L), indicating it is exploitable over a network with low attack complexity, no required privileges, but user interaction is necessary. An unprivileged remote attacker can trigger it by supplying a malicious file for processing by an application using Assimp, potentially causing a limited denial of service such as application crashes, with no impact on confidentiality or integrity.

Advisories and reports are documented on the Assimp GitHub repository in issue #6013, including detailed comments at #issue-2877371176, as well as VulDB entries at ctiid.300857, id.300857, and submit.517786. These resources provide vulnerability details, and practitioners should consult them for any updates on patches or workarounds. The exploit has been publicly disclosed and may be used, with the CVE published on 2025-03-25T08:15:20.193.

Details

CWE(s)

Affected Products

assimp
assimp
5.4.3

CVEs Like This One

CVE-2025-2755Same product: Assimp Assimp
CVE-2025-2753Same product: Assimp Assimp
CVE-2025-2751Same product: Assimp Assimp
CVE-2025-3015Same product: Assimp Assimp
CVE-2025-15538Same product: Assimp Assimp
CVE-2025-2592Same product: Assimp Assimp
CVE-2025-2152Same product: Assimp Assimp
CVE-2025-2750Same product: Assimp Assimp
CVE-2025-2151Same product: Assimp Assimp
CVE-2025-2757Same product: Assimp Assimp

References