CVE-2025-3158: Assimp Heap Buffer Overflow Vulnerability

CVE-2025-3158 Overview

CVE-2025-3158 is a heap-based buffer overflow in the Open Asset Import Library (Assimp) version 5.4.3. The flaw resides in the Assimp::LWO::AnimResolver::UpdateAnimRangeSetup function within code/AssetLib/LWO/LWOAnimation.cpp, part of the LightWave Object (LWO) file handler. An attacker with local access can trigger the overflow by supplying a crafted LWO file to an application that links Assimp for asset parsing. The issue has been publicly disclosed, and proof-of-concept details are available through VulDB and the upstream Assimp issue tracker. Assimp is widely embedded in 3D content pipelines, game engines, and CAD tools, expanding the potential blast radius wherever untrusted model files are processed.

Critical Impact
A crafted LWO animation file processed by Assimp 5.4.3 corrupts the heap, enabling potential local code execution or process crash in any application linking the vulnerable library.

Affected Products

Open Asset Import Library (Assimp) version 5.4.3
Applications and game engines statically or dynamically linking Assimp 5.4.3 for LWO file parsing
Content pipelines and asset converters that ingest untrusted LightWave Object files

Discovery Timeline

2025-04-03 - CVE-2025-3158 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3158

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer). It is triggered when Assimp parses a maliciously crafted LWO file and invokes Assimp::LWO::AnimResolver::UpdateAnimRangeSetup. The affected code path handles animation range setup for LWO scene data. Improper validation of bounds during animation range resolution allows attacker-controlled input to write past the intended heap allocation. Because Assimp is embedded in many downstream tools, the vulnerable code executes with the privileges of the host application whenever it opens an untrusted model.

Root Cause

The root cause is missing or insufficient boundary checks in UpdateAnimRangeSetup inside code/AssetLib/LWO/LWOAnimation.cpp. When the resolver iterates over animation ranges derived from file-supplied fields, the resulting index or size computation exceeds the destination buffer. This condition corrupts adjacent heap metadata or object data, creating a memory safety violation exploitable through carefully shaped LWO content.

Attack Vector

Exploitation requires local access and the ability to have the target application load an attacker-supplied LWO file. The attacker crafts a file with malformed animation range structures that force the vulnerable resolver into an out-of-bounds write. Depending on the surrounding heap layout, the outcome ranges from denial of service to arbitrary code execution in the context of the process consuming the file. See the Assimp GitHub Issue #6023 and VulDB entry #303104 for technical reproduction details.

Detection Methods for CVE-2025-3158

Indicators of Compromise

Unexpected crashes, SIGABRT, or heap corruption reports from applications that invoke Assimp when opening .lwo or .lws files
Presence of Assimp 5.4.3 binaries (libassimp.so.5.4.3, assimp.dll) in installed application directories
LWO files originating from untrusted sources placed in shared asset directories or transferred via removable media

Detection Strategies

Inventory software that bundles Assimp and identify version 5.4.3 through file hash comparison or dependency manifests
Enable AddressSanitizer or heap protection features in development builds to surface the overflow during file ingestion tests
Correlate application crash telemetry with LWO file open events to identify targeted parsing attempts

Monitoring Recommendations

Monitor process creation and crash logs for applications that link Assimp when handling user-supplied 3D assets
Log file-open events for .lwo and .lws extensions in asset processing pipelines and CI systems
Alert on repeated abnormal terminations of asset conversion services, which may indicate exploitation attempts

How to Mitigate CVE-2025-3158

Immediate Actions Required

Identify all applications and services that embed Assimp 5.4.3 and restrict them from processing untrusted LWO files
Isolate asset ingestion workflows in sandboxed or containerized environments with least privilege
Block or quarantine LWO files received from external or unverified sources until a patched build is deployed

Patch Information

No fixed version is listed in the NVD entry at the time of publication. Track upstream remediation through the Assimp GitHub Issue #6023 and rebuild dependent applications against a patched Assimp release once available. Software vendors that ship Assimp should update their bundled copies and re-release affected products.

Workarounds

Disable LWO file import in applications where the format is not required
Run asset conversion tools inside a sandbox such as Firejail, a container, or a dedicated low-privilege service account
Validate incoming LWO files with format-aware scanners before passing them to Assimp-backed pipelines

bash

# Example: run an Assimp-based converter in an isolated Firejail sandbox
firejail --private --net=none --read-only=/usr \
  assimp export untrusted_input.lwo /tmp/out.obj