CVE-2025-2753: Assimp Out-of-Bounds Read Vulnerability

CVE-2025-2753 Overview

CVE-2025-2753 affects Open Asset Import Library (Assimp) version 5.4.3, a widely used library for importing 3D model formats into applications and game engines. The flaw resides in the SceneCombiner::MergeScenes function within code/AssetLib/LWS/LWSLoader.cpp, which handles LightWave Scene (LWS) files. Processing a maliciously crafted LWS file triggers an out-of-bounds read, classified as [CWE-119]. The issue was disclosed publicly through a GitHub issue and tracked by VulDB as entry #300858. Attackers can deliver the malicious file remotely, requiring only that a user or application open it through any program embedding the vulnerable Assimp version.

Critical Impact

Remote attackers can trigger an out-of-bounds memory read in any application using Assimp 5.4.3 to parse LWS files, leading to information disclosure or process crashes.

Affected Products

• Open Asset Import Library (Assimp) 5.4.3
• Applications and game engines bundling Assimp 5.4.3 for LWS asset import
• Build pipelines and 3D content processing tools using the LWSLoader component

Discovery Timeline

• 2025-03-25 - CVE-2025-2753 published to the National Vulnerability Database (NVD)
• 2025-07-17 - Last updated in NVD database

Technical Details for CVE-2025-2753

Vulnerability Analysis

The vulnerability resides in Assimp's LightWave Scene file loader. When parsing an LWS file, LWSLoader constructs intermediate scene structures and hands them to SceneCombiner::MergeScenes for consolidation into the final aiScene object. The merge logic reads from buffers whose bounds are derived from attacker-controlled values inside the LWS file. A crafted file can supply index or count values that exceed the actual allocated buffer length.

The read past the allocated region can leak adjacent process memory back through error paths or subsequent processing. It can also crash the host application, producing a denial-of-service condition in tools that batch-process untrusted 3D assets. Because Assimp is embedded in many downstream products, the blast radius extends beyond the library itself to any consumer that exposes import functionality.

Root Cause

The root cause is missing or insufficient bounds checking inside SceneCombiner::MergeScenes when iterating over scene components sourced from LWSLoader. The function trusts counts and indices parsed from the file rather than validating them against the actual sizes of merged arrays, classifying the issue under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer).

Attack Vector

Exploitation requires the victim to open or import a malicious LWS file using software that links against Assimp 5.4.3. Delivery channels include email attachments, asset marketplaces, modding portals, and shared project repositories. User interaction is required, but no authentication or elevated privileges are needed against the target process. The exploit details have been disclosed publicly through the Assimp GitHub issue tracker.

No verified proof-of-concept code is available in the referenced sources. See the GitHub Issue Discussion and VulDB #300858 for additional technical context.

Detection Methods for CVE-2025-2753

Indicators of Compromise

• LWS files originating from untrusted sources or with anomalously large index or count fields in their scene definitions
• Application crashes, segmentation faults, or unexpected exits in processes that recently loaded .lws content
• Crash dumps referencing SceneCombiner::MergeScenes or LWSLoader frames in the call stack

Detection Strategies

• Inventory build artifacts, game engines, and 3D processing tools for embedded copies of Assimp 5.4.3 using software composition analysis
• Hash-match or sandbox-detonate inbound .lws files against a controlled Assimp build with AddressSanitizer to surface out-of-bounds reads
• Hunt for process termination events on workstations that handle untrusted 3D content, correlating with recent file open activity

Monitoring Recommendations

• Forward endpoint process crash telemetry and file-handling events to a centralized data lake for correlation with file delivery sources
• Alert on unusual .lws file ingestion in asset pipelines, content moderation queues, and CI build agents
• Track outbound network connections from 3D modeling and game engine processes immediately after file parsing operations

How to Mitigate CVE-2025-2753

Immediate Actions Required

• Identify all internal and third-party software using Assimp 5.4.3 and prioritize systems exposed to externally sourced 3D assets
• Block ingestion of .lws files from untrusted senders at email and file-sharing gateways until patched builds are deployed
• Restrict 3D asset import workflows to dedicated, sandboxed workstations isolated from sensitive data

Patch Information

No vendor patch URL is included in the NVD record at the time of publication. Monitor the Assimp GitHub repository issue tracker for fix commits and rebuild downstream applications against a patched version once available. Vendors that embed Assimp should track upstream changes to LWSLoader.cpp and SceneCombiner.cpp and ship updated builds to customers.

Workarounds

• Disable or remove the LWS importer in custom Assimp builds by excluding ASSIMP_BUILD_LWS_IMPORTER from the build configuration
• Pre-filter incoming 3D assets to reject the .lws format at upload, intake, or pipeline boundaries
• Run import operations inside hardened sandboxes or containers with no network egress and minimal filesystem access to contain the impact of a successful out-of-bounds read

# Example CMake configuration to exclude the vulnerable LWS importer
cmake -DASSIMP_BUILD_ALL_IMPORTERS_BY_DEFAULT=ON \
      -DASSIMP_BUILD_LWS_IMPORTER=OFF \
      -DASSIMP_BUILD_TESTS=OFF \
      ..
make -j$(nproc)