CVE-2025-11277: Assimp Heap Buffer Overflow Vulnerability

CVE-2025-11277 Overview

CVE-2025-11277 is a heap-based buffer overflow [CWE-119] in the Open Asset Import Library (Assimp) version 6.0.2. The flaw resides in the Q3DImporter::InternReadFile function inside assimp/code/AssetLib/Q3D/Q3DLoader.cpp. An attacker with local access can supply a crafted Quick3D (.q3d/.q3s) asset file that triggers an out-of-bounds write on the heap during parsing. A public proof-of-concept has been published, increasing the likelihood that opportunistic attackers will weaponize the issue against applications, game engines, and 3D tooling that embed Assimp for model import.

Critical Impact
Local processing of a malicious Quick3D asset can corrupt heap memory in any application linking Assimp 6.0.2, enabling denial of service and potentially arbitrary code execution in the parsing process.

Affected Products

Open Asset Import Library (Assimp) 6.0.2
Applications, engines, and 3D content pipelines that statically or dynamically link Assimp 6.0.2
Downstream distributions and packages shipping the vulnerable Assimp release

Discovery Timeline

2025-10-05 - CVE-2025-11277 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11277

Vulnerability Analysis

Assimp is a widely used C++ library that imports dozens of 3D asset formats into a common in-memory scene graph. The Quick3D importer parses .q3d and .q3s model files through Q3DImporter::InternReadFile. CVE-2025-11277 is a heap-based buffer overflow [CWE-119] triggered when a malformed Quick3D file is loaded. The parser reads size or count fields from the untrusted file and uses them to allocate or index a heap buffer without adequately validating the values against the actual data remaining in the stream. When the fields are inflated or otherwise inconsistent, the loop writes past the end of the allocated buffer.

The attack path requires local access, meaning the attacker must place a malicious file on the system or coax a local user or application into passing it to Assimp. Successful exploitation corrupts adjacent heap metadata and objects, which commonly results in a process crash and can be leveraged for arbitrary code execution in the security context of the process performing the import.

Root Cause

The root cause is insufficient bounds checking in Q3DImporter::InternReadFile within assimp/code/AssetLib/Q3D/Q3DLoader.cpp. Attacker-controlled length and count values from the Quick3D file drive heap allocation and copy operations without validating that the declared sizes match the file's actual contents. This is a classic input-validation failure in a binary format parser.

Attack Vector

Exploitation is local. An attacker delivers a crafted Quick3D asset and induces a victim application to open it through Assimp. Common delivery paths include shared model repositories, modding channels, game asset bundles, and CAD or DCC (Digital Content Creation) workflows. A public proof-of-concept has been published as a poc.zip artifact linked from the upstream issue tracker.

Detailed technical context is available in Assimp GitHub Issue #6358 and the VulDB entry #327011. No verified exploit source code is reproduced here.

Detection Methods for CVE-2025-11277

Indicators of Compromise

Unexpected crashes, segmentation faults, or heap corruption reports in processes that call Assimp when loading .q3d or .q3s files
Presence of the public poc.zip sample or similarly malformed Quick3D files in user download directories, asset caches, or shared project folders
Application logs showing failed asset imports from the Quick3D loader immediately followed by process termination

Detection Strategies

Inventory build artifacts and third-party dependencies to identify binaries that link Assimp 6.0.2, including game engines, 3D viewers, and CAD plugins
Enable AddressSanitizer or equivalent heap instrumentation in development and CI builds to catch out-of-bounds writes in the Quick3D importer
Add file-format allowlisting at ingest points so untrusted Quick3D files are blocked or sandboxed before reaching Assimp

Monitoring Recommendations

Alert on repeated crashes of asset-processing services and creative applications correlated with recently opened files
Monitor endpoint telemetry for child-process anomalies and memory-access violations originating from applications known to embed Assimp
Track file provenance for 3D assets entering build pipelines, flagging files sourced from untrusted repositories or user uploads

How to Mitigate CVE-2025-11277

Immediate Actions Required

Identify every product and internal tool that ships Assimp 6.0.2 and prioritize those that accept untrusted 3D content
Restrict opening of Quick3D (.q3d, .q3s) files from unverified sources until a fixed build is deployed
Run asset-import workloads in a sandboxed, least-privilege process so heap corruption cannot escalate beyond the parser

Patch Information

At the time of publication, no fixed Assimp release is referenced in the CVE record. Track the upstream issue at Assimp GitHub Issue #6358 and the VulDB advisory #327011 for patch commits and release notes. Once a patched Assimp version ships, rebuild and redistribute any downstream applications that statically link the library.

Workarounds

Disable the Quick3D importer in Assimp build configurations if the format is not required by the host application
Validate 3D assets with a separate, hardened parser or format allowlist before invoking Assimp on user-supplied files
Enforce operating-system exploit mitigations such as ASLR, DEP/NX, and heap hardening for processes that call Assimp

bash

# Disable the Quick3D importer at build time to remove the vulnerable code path
cmake -S . -B build \
  -DASSIMP_BUILD_Q3D_IMPORTER=OFF \
  -DASSIMP_BUILD_ALL_IMPORTERS_BY_DEFAULT=ON
cmake --build build --config Release