CVE-2025-15666

MEDIUM

Open Asset Import Library Assimp Model File SceneCombiner.cpp Copy heap-based overflow

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-15666. PoCs published by HermesNA-1.

AI-analyzed exploit summary This repository contains an auto-generated placeholder module for CVE-2025-15666, a vulnerability in Open Asset Import Library (Assimp) up to version 5.4.3. The module includes a basic connectivity check but lacks actual exploit code or technical details about the vulnerability's mechanics.

Description

A security vulnerability has been detected in Open Asset Import Library Assimp up to 5.4.3. Affected by this vulnerability is the function Assimp::SceneCombiner::Copy of the file code/Common/SceneCombiner.cpp of the component Model File Handler. Such manipulation of the argument width/height leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. This and similar defects are tracked and handled via issue #6128.

Exploits (1)

github STUB 1 stars
by HermesNA-1 · pythonpoc
https://github.com/HermesNA-1/SnakeSploit/tree/main/data/modules_generated/cve-2025-15666_security_vulnerability_has.py

This repository contains an auto-generated placeholder module for CVE-2025-15666, a vulnerability in Open Asset Import Library (Assimp) up to version 5.4.3. The module includes a basic connectivity check but lacks actual exploit code or technical details about the vulnerability's mechanics.

Classification
Stub 98%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: Open Asset Import Library (Assimp) up to 5.4.3
No auth needed
Prerequisites: Network access to the target service/port
mistral-large-3 · analyzed Jul 09, 2026 Full analysis →

References (5)

Core 5
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-374595 | Open Asset Import Library Assimp Model File SceneCombiner.cpp Copy heap-based overflow
https://vuldb.com/vuln/374595
Signature, Permissions Required signature permissions-required
VDB-374595 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/vuln/374595/cti
Third Party Advisory third-party-advisory
CVE-2025-15666 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2025-15666
Third Party Advisory third-party-advisory
Submit #844487 | Assimp v5.4.3 Heap-based Buffer Overflow
https://vuldb.com/submit/844487
Exploit exploit issue-tracking
https://github.com/assimp/assimp/issues/6079

Scores

CVSS v3 5.3
EPSS 0.0012
EPSS Percentile 2.5%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-119 CWE-122
Status published
Products (4)
Open Asset Import Library/Assimp 5.4.0
Open Asset Import Library/Assimp 5.4.1
Open Asset Import Library/Assimp 5.4.2
Open Asset Import Library/Assimp 5.4.3
Published Jul 01, 2026
Tracked Since Jul 01, 2026