Skip to content
OpenAdvisories
Medium · 5.3 CVE-2025-15666 EUVD-2025-210394GHSA-5hv8-2h72-hc2x

Open Asset Import Library Assimp Model File SceneCombiner.cpp Copy heap-based overflow

Published Jul 1, 2026 · Updated Jul 1, 2026 · Assigned by VulDB

Description

A security vulnerability has been detected in Open Asset Import Library Assimp up to 5.4.3. Affected by this vulnerability is the function Assimp::SceneCombiner::Copy of the file code/Common/SceneCombiner.cpp of the component Model File Handler. Such manipulation of the argument width/height leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. This and similar defects are tracked and handled via issue #6128.

Affected products

VendorProductAffectedFixed
Open Asset Import Library Assimp 5.4.0, 5.4.1, 5.4.2, 5.4.3 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 assimp No fix yet —
Debian 13 assimp No fix yet —
Debian 12 assimp No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 assimp No fix yet —
Ubuntu 26.04 LTS assimp No fix yet —
Ubuntu 25.10 assimp No fix yet —
Ubuntu 24.04 LTS assimp No fix yet —
Ubuntu 22.04 LTS assimp No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS assimp No fix yet —
Ubuntu 18.04 LTS assimp No fix yet —
Ubuntu 16.04 LTS assimp No fix yet —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2 qt5-qt3d +2 5.15.3-1.amzn2.0.11 ALAS2-2026-3994

Advisories 1

References