CVE-2025-2755: Assimp AC3D File Handler RCE Vulnerability

CVE-2025-2755 Overview

CVE-2025-2755 is an out-of-bounds read vulnerability in the Open Asset Import Library (Assimp) version 5.4.3. The flaw resides in the Assimp::AC3DImporter::ConvertObjectSection function within code/AssetLib/AC/ACLoader.cpp, part of the AC3D File Handler component. Manipulation of the src.entries argument triggers reads beyond allocated buffer boundaries [CWE-119]. The issue can be reached when an application using Assimp parses an attacker-supplied AC3D model file. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse against applications that embed the library.

Critical Impact

Attackers can craft a malicious AC3D file to trigger an out-of-bounds read, potentially causing application crashes or leaking adjacent process memory.

Affected Products

• Open Asset Import Library (Assimp) 5.4.3
• Applications and game engines that bundle Assimp 5.4.3 for 3D asset import
• Build pipelines invoking Assimp to process untrusted AC3D (.ac) files

Discovery Timeline

• 2025-03-25 - CVE-2025-2755 published to NVD
• 2025-07-17 - Last updated in NVD database

Technical Details for CVE-2025-2755

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-119] in Assimp's AC3D importer. Assimp is a widely embedded C++ library that converts 3D model formats into a unified scene graph. The AC3D loader processes object sections from .ac files and iterates through entry structures referenced by src.entries. When the loader trusts attacker-controlled count or index fields without validating them against the actual entry buffer size, the read crosses the allocation boundary.

The attack vector is network-reachable because applications routinely accept 3D assets from remote sources, asset marketplaces, or user uploads. Exploitation requires user interaction in the form of opening or importing a malicious AC3D file. Successful exploitation can disclose adjacent heap memory or terminate the host process, undermining availability and confidentiality of the embedding application.

Root Cause

The root cause is missing bounds validation in Assimp::AC3DImporter::ConvertObjectSection when iterating over src.entries. The loader dereferences entry elements without confirming that the index range stays within the parsed entry vector, allowing the read to escape allocated memory.

Attack Vector

An attacker crafts a malformed AC3D file with manipulated entry counts or offset values. The attacker delivers the file through any channel the target application accepts — web upload forms, email attachments, asset packs, or shared scene files. When the victim opens the file in an Assimp-backed viewer, editor, or game engine, the AC3D importer triggers the out-of-bounds read during scene conversion.

The vulnerability is documented in the Assimp GitHub Issue #6017, which contains the technical analysis of the faulty code path.

Detection Methods for CVE-2025-2755

Indicators of Compromise

• Unexpected crashes or segmentation faults in processes that import .ac (AC3D) files using Assimp 5.4.3
• Application logs showing exceptions inside ACLoader.cpp or the ConvertObjectSection call path
• Inbound AC3D files from untrusted users, marketplaces, or external email sources targeting asset pipelines

Detection Strategies

• Inventory all software linking against assimp 5.4.3 using Software Bill of Materials (SBOM) tools or dependency scanners
• Monitor file ingestion services for AC3D files exceeding typical sizes or containing malformed object section headers
• Run Assimp-based importers under address sanitizers (ASan) in test environments to catch out-of-bounds reads during fuzzing

Monitoring Recommendations

• Alert on repeated crashes of asset processing services that correlate with AC3D file uploads
• Forward application crash telemetry and core dumps to a centralized logging platform for triage
• Review web application logs for upload patterns where .ac files precede service errors

How to Mitigate CVE-2025-2755

Immediate Actions Required

• Identify all applications and services that bundle Assimp 5.4.3 and prioritize those exposed to untrusted file input
• Disable the AC3D importer in Assimp configuration if your application does not require AC3D support
• Restrict acceptance of .ac files at upload boundaries until a patched library version is deployed

Patch Information

At the time of publication, no fixed Assimp release is referenced in the NVD entry. Monitor the upstream Assimp repository and Assimp Issue #6017 for commits addressing the ConvertObjectSection bounds check. Rebuild and redistribute any downstream products once a patched version is released.

Workarounds

• Filter or block AC3D (.ac) file uploads at the application gateway when AC3D support is not business-critical
• Sandbox asset import operations in a low-privilege process or container to limit memory disclosure scope
• Validate file structure with a separate parser before handing the file to Assimp, rejecting files with inconsistent entry counts

# Example: block .ac file uploads at an nginx ingress until patched
location /upload {
    if ($request_filename ~* \.ac$) {
        return 415;
    }
    client_max_body_size 10m;
    proxy_pass http://asset_importer;
}