CVE-2025-2751: Assimp Out-of-Bounds Read Vulnerability

CVE-2025-2751 Overview

CVE-2025-2751 is an out-of-bounds read vulnerability in Open Asset Import Library (Assimp) version 5.4.3. The flaw exists in the Assimp::CSMImporter::InternReadFile function within code/AssetLib/CSM/CSMLoader.cpp, part of the CSM file handler component. Attackers exploit the issue by manipulating the na argument when the library parses a crafted Character Studio Motion (CSM) file. The exploit has been publicly disclosed, increasing the risk of opportunistic abuse against applications and game engines that embed Assimp for 3D asset import.

Critical Impact

Remote attackers can trigger an out-of-bounds memory read in any application that imports a malicious CSM file using Assimp 5.4.3, potentially leaking process memory or crashing the host process.

Affected Products

• Open Asset Import Library (Assimp) 5.4.3
• Applications and engines bundling Assimp 5.4.3 for 3D model import
• Downstream Linux distribution packages shipping the affected version

Discovery Timeline

• 2025-03-25 - CVE-2025-2751 published to NVD
• 2025-07-17 - Last updated in NVD database

Technical Details for CVE-2025-2751

Vulnerability Analysis

The vulnerability is classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer). It manifests as an out-of-bounds read inside the CSM file loader. Assimp is a widely embedded C++ library used by game engines, 3D modeling tools, and content pipelines to parse dozens of asset formats. A read past the end of an allocated buffer can disclose adjacent heap memory or cause the importing process to crash.

User interaction is required: a victim must open or import a malicious CSM file. The attack vector is network-reachable, since asset files are routinely downloaded, distributed via marketplaces, or accepted as user uploads.

Root Cause

The defect resides in Assimp::CSMImporter::InternReadFile in code/AssetLib/CSM/CSMLoader.cpp. The function processes the na argument, which represents an animation node count parsed from the input file, without validating it against the actual size of the underlying buffer. When na exceeds the buffer bounds, subsequent indexing reads memory outside the allocated region.

Attack Vector

An attacker crafts a CSM motion file containing a manipulated na value and delivers it to a target through email attachments, web downloads, asset marketplaces, or upload endpoints in applications that accept 3D content. When the target application calls Assimp to import the file, the parser dereferences out-of-bounds memory. The result is information disclosure of adjacent heap data or an application crash producing a denial-of-service condition. The public disclosure of the issue on GitHub increases exposure for unpatched deployments.

Refer to the GitHub Issue Discussion and VulDB entry #300856 for additional technical detail.

Detection Methods for CVE-2025-2751

Indicators of Compromise

• Unexpected crashes or segmentation faults in processes that link against libassimp after opening CSM files
• CSM files originating from untrusted sources with abnormally large or inconsistent node count fields
• Application logs showing exceptions raised inside CSMImporter::InternReadFile

Detection Strategies

• Inventory software that bundles Assimp and identify instances on version 5.4.3 using software composition analysis (SCA) tooling
• Inspect inbound CSM files at email and web gateways and flag samples whose declared node counts exceed file size constraints
• Enable AddressSanitizer or equivalent runtime memory checks in development and QA builds to surface out-of-bounds reads during fuzzing

Monitoring Recommendations

• Monitor endpoints for repeated crashes of 3D content tools and game engines that embed Assimp
• Forward crash telemetry and core dump metadata into the SIEM and correlate with recently opened asset files
• Track upstream Assimp releases and GitHub issue #6012 for fix availability

How to Mitigate CVE-2025-2751

Immediate Actions Required

• Identify all applications and pipelines that depend on Assimp 5.4.3 and prioritize them for update
• Restrict ingestion of CSM files from untrusted sources until a fixed library version is deployed
• Sandbox asset import workflows so a parser crash cannot affect the broader host process

Patch Information

At the time of publication, no fixed Assimp release is referenced in the NVD record. Track the upstream project and apply the next stable release that addresses GitHub issue #6012. Rebuild and redistribute any downstream applications that statically link the library.

Workarounds

• Disable the CSM importer at build time by excluding CSMLoader.cpp from Assimp compilation when CSM support is not required
• Validate the na node count field against the input file size before passing CSM content to Assimp
• Run asset import in a low-privilege, isolated process with strict file system and network restrictions

# Disable CSM importer when building Assimp from source
cmake -DASSIMP_BUILD_CSM_IMPORTER=OFF \
      -DASSIMP_BUILD_TESTS=OFF \
      -DCMAKE_BUILD_TYPE=Release \
      -S . -B build
cmake --build build --config Release