CVE-2025-15538: Assimp Use After Free Vulnerability

CVE-2025-15538 Overview

A use-after-free vulnerability has been identified in the Open Asset Import Library (Assimp) versions up to 6.0.2. The vulnerability exists in the Assimp::LWOImporter::FindUVChannels function located in the file /src/assimp/code/AssetLib/LWO/LWOMaterial.cpp. This memory corruption vulnerability can be triggered through manipulation of specially crafted LWO (LightWave Object) files, potentially leading to memory corruption and application instability.

Critical Impact

Local attackers with low privileges can exploit this use-after-free vulnerability in Assimp's LWO file parser to corrupt memory, potentially causing application crashes or enabling further exploitation in applications that process untrusted 3D model files.

Affected Products

• Open Asset Import Library (Assimp) up to version 6.0.2
• Applications and software utilizing Assimp library for 3D model import
• Game engines and 3D visualization tools incorporating vulnerable Assimp versions

Discovery Timeline

• 2026-01-18 - CVE-2025-15538 published to NVD
• 2026-01-18 - Last updated in NVD database

Technical Details for CVE-2025-15538

Vulnerability Analysis

This vulnerability is classified as a use-after-free memory corruption issue (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer). The flaw resides within the LWO (LightWave Object) file import functionality of the Assimp library.

The vulnerable function Assimp::LWOImporter::FindUVChannels improperly handles memory during the parsing of UV channel data from LWO format files. When processing malformed or specially crafted input, the function may attempt to access memory that has already been freed, leading to undefined behavior.

A proof-of-concept has been publicly disclosed, and the exploit details are being tracked in the Assimp GitHub Issue #6258. The vulnerability requires local access to exploit, meaning an attacker would need to convince a user to open a malicious LWO file or have the ability to place malicious files on the target system.

Root Cause

The root cause of this vulnerability stems from improper memory lifecycle management within the LWO material processing code. The FindUVChannels function fails to properly track the validity of memory references when iterating through UV channel data structures. When certain conditions are met during file parsing, the code may access deallocated memory objects, resulting in a use-after-free condition.

This type of vulnerability typically occurs when:

• Memory is allocated for UV channel data structures
• The memory is subsequently freed during processing
• A dangling pointer to the freed memory is later dereferenced

Attack Vector

The attack requires local access with low privileges. An attacker would need to craft a malicious LWO file and have it processed by an application using the vulnerable Assimp library. The attack scenario involves:

1. Crafting a specially malformed LWO file that triggers the memory corruption condition
2. Delivering the malicious file to a target system through social engineering or file sharing
3. Having the victim application (game engine, 3D modeling tool, etc.) process the malicious file
4. The use-after-free condition triggers during UV channel processing, potentially corrupting memory

The vulnerability mechanism involves improper memory handling during LWO file parsing. When the FindUVChannels function processes UV data from a crafted input file, it may reference memory that has been freed, leading to memory corruption. Detailed technical analysis is available in the GitHub Issue Comment and the PoC archive on the project repository.

Detection Methods for CVE-2025-15538

Indicators of Compromise

• Unexpected crashes or segmentation faults in applications processing LWO files
• Memory corruption errors reported by AddressSanitizer or similar tools when parsing LWO models
• Suspicious or malformed LWO files with abnormal UV channel data structures

Detection Strategies

• Implement file integrity monitoring for directories where 3D model files are stored
• Deploy memory sanitization tools (ASan, MSan) in development and testing environments to detect use-after-free conditions
• Monitor application logs for crashes related to Assimp LWO import operations
• Use static analysis tools to scan for vulnerable Assimp library versions in your software supply chain

Monitoring Recommendations

• Establish baseline behavior for 3D model processing applications and alert on anomalies
• Configure crash dump collection and analysis for applications using Assimp
• Implement software composition analysis (SCA) to track Assimp library versions across your environment
• Monitor for unusual file access patterns involving LWO format files

How to Mitigate CVE-2025-15538

Immediate Actions Required

• Inventory all applications and systems using the Assimp library and identify vulnerable versions (up to 6.0.2)
• Restrict processing of untrusted LWO files until patches are applied
• Implement input validation and sandboxing for 3D model import operations
• Monitor the Assimp GitHub repository for official patch releases

Patch Information

This vulnerability is being tracked in the Assimp project via issue #6128 (referenced as #6128 in CVE description). Organizations should monitor the official Assimp repository for security updates and apply patches when available. Additional tracking information is available through VulDB #341727.

Workarounds

• Disable LWO file import functionality if not required by your application
• Implement strict file validation before processing LWO files through Assimp
• Run applications that process 3D models in sandboxed or isolated environments
• Use allowlisting to only permit processing of trusted LWO files from verified sources

# Configuration example - Compile Assimp with Address Sanitizer for detection
cmake -DCMAKE_CXX_FLAGS="-fsanitize=address -fno-omit-frame-pointer" \
      -DCMAKE_C_FLAGS="-fsanitize=address -fno-omit-frame-pointer" \
      -DCMAKE_BUILD_TYPE=Debug ..

# Run application with ASan to detect use-after-free issues
ASAN_OPTIONS=detect_stack_use_after_return=1:halt_on_error=0:log_path=asan.log \
./your_assimp_application input_file.lwo