A weakness has been identified in Open Asset Import Library Assimp 6.0.2. This affects the function Q3DImporter::InternReadFile of the file assimp/code/AssetLib/Q3D/Q3DLoader.cpp. Executing a manipulation can lead to heap-based buffer overflow. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks.
CVSS Details
- CVSS 4.0 Base Score: 1.9 (LOW)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade qt5-qt3d-develUpgrade qt5-qt3dUpgrade qt5-qt3d-examples | Nov 20, 2025 | Nov 11, 2025 |
| Alpine Linux | — | Upgrade assimp | May 4, 2026 | Oct 5, 2025 |
| Amazon Linux Ami 2 | — | Upgrade qt5-qt3d-develUpgrade qt5-qt3d-examplesUpgrade qt5-qt3dUpgrade qt5-qt3d-debuginfo | May 20, 2026 | May 20, 2026 |
| Oracle_linux | — | Upgrade qt5-qt3dUpgrade qt6-qtquick3dUpgrade qt5-qt3d-develUpgrade qt6-qtquick3d-examplesUpgrade qt5-qt3d-examplesUpgrade qt6-qtquick3d-devel | Nov 10, 2025 | Oct 5, 2025 |
| Redhat_linux | — | Upgrade qt6-qtquick3d-develUpgrade qt5-qt3d-debuginfoUpgrade qt5-qt3d-debugsourceUpgrade qt5-qt3d-devel-debuginfoUpgrade qt6-qtquick3dUpgrade qt5-qt3d-examples-debuginfoUpgrade qt5-qt3d-develUpgrade qt6-qtquick3d-devel-debuginfoUpgrade qt5-qt3dUpgrade qt6-qtquick3d-debugsourceUpgrade qt6-qtquick3d-examples-debuginfoUpgrade qt6-qtquick3d-debuginfoUpgrade qt6-qtquick3d-tests-debuginfoUpgrade qt6-qtquick3d-examplesUpgrade qt5-qt3d-tests-debuginfoUpgrade qt5-qt3d-examples | Nov 7, 2025 | Oct 5, 2025 |
| Rocky_linux | — | Upgrade qt5-qt3d-develUpgrade qt5-qt3d-examples-debuginfoUpgrade qt6-qtquick3dUpgrade qt5-qt3d-examplesUpgrade qt6-qtquick3d-debuginfoUpgrade qt5-qt3dUpgrade qt5-qt3d-debuginfoUpgrade qt6-qtquick3d-devel-debuginfoUpgrade qt5-qt3d-devel-debuginfoUpgrade qt5-qt3d-debugsourceUpgrade qt6-qtquick3d-debugsourceUpgrade qt6-qtquick3d-examplesUpgrade qt6-qtquick3d-examples-debuginfoUpgrade qt6-qtquick3d-devel | Feb 5, 2026 | Dec 2, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub