CVE-2025-3158
Memory Safety in Assimp 5.4.3
Raw vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2025-3158 is a medium-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Assimp Assimp. Its CVSS base score is 4.8 (Medium).
Operationally, ranked at the 23th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-16 (Memory Protection) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-9637
Vulnerability Data
A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. Affected by this issue is the function Assimp::LWO::AnimResolver::UpdateAnimRangeSetup of the file code/AssetLib/LWO/LWOAnimation.cpp of the component LWO File Handler. The manipulation leads to heap-based…
more
buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Enforces validation of untrusted LWO file input before it reaches Assimp::LWO::AnimResolver::UpdateAnimRangeSetup, directly blocking the malformed data that triggers the heap overflow.
Requires memory-protection mechanisms (ASLR, NX, guard pages, etc.) that raise the difficulty or prevent successful exploitation of the heap-based buffer overflow in the LWO handler.
Mandates timely patching or replacement of the vulnerable Assimp 5.4.3 LWOAnimation.cpp code once a fixed version is released, eliminating the root cause.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure-development practices directly require bounds checking and safe memory handling that prevent heap overflows.
Vulnerability scanning and code analysis directly surface buffer-boundary flaws.
Receiving and triaging vulnerability disclosures commonly includes buffer-related reports.
Developer training on secure coding reduces introduction of memory-buffer errors.
Patching replaces vulnerable code containing buffer-boundary defects.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches out-of-bounds accesses before release, covering most instances of the weakness.
Secure development lifecycle mandates memory-safety practices that directly prevent buffer-boundary violations.
Application security requirements can specify memory-safety rules, but do not prescribe implementation details.
Secure architecture and engineering principles include memory-safe design patterns that mitigate buffer overflows.
Secure coding standards explicitly forbid unsafe buffer operations, directly eliminating CWE-119.
Change management ensures controlled deployment of fixes for discovered heap-overflow vulnerabilities.