Catalogue CVE

CVE-2025-3160

assimp affected and fixed versions

A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::SceneCombiner::AddNodeHashes of the file code/Common/SceneCombiner.cpp of the component File Handler. The manipulation leads to out-of-bounds read. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as a0993658f40d8e13ff5823990c30b43c82a5daf0. It is recommended to apply a patch to fix this issue.

Gravité: Low · CVSS 3.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Published: Apr 3, 2025, 2:31:06 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.28% · Oct 27, 2026

Projects and upstream resources

[assimp][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiansid	assimp	`6.0.2+ds-1`	FixedDistribution-reported fixed boundary	[CVE-2025-3160]
Debiansid	assimp	`6.0.5+ds-1`	Fixed	[CVE-2025-3160]
Debianforky	assimp	`6.0.2+ds-1`	FixedDistribution-reported fixed boundary	[CVE-2025-3160]
Debianforky	assimp	`6.0.5+ds-1`	Fixed	[CVE-2025-3160]

Showing 4 fix observations. All 9 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
UnknownRelease not reported	assimp	Not reported	UnknownSource applicability is not established	Provider not reported
Debianbookworm	assimp	Not reported	AffectedDistribution reports no fix	[CVE-2025-3160]
Debianbookworm	assimp	`5.2.5~ds0-1`	Affected	[CVE-2025-3160]
Debianforky	assimp	`6.0.2+ds-1`	FixedDistribution-reported fixed boundary	[CVE-2025-3160]
Debianforky	assimp	`6.0.5+ds-1`	Fixed	[CVE-2025-3160]
Debiansid	assimp	`6.0.2+ds-1`	FixedDistribution-reported fixed boundary	[CVE-2025-3160]
Debiansid	assimp	`6.0.5+ds-1`	Fixed	[CVE-2025-3160]
Debiantrixie	assimp	Not reported	AffectedDistribution reports no fix	[CVE-2025-3160]
Debiantrixie	assimp	`5.4.3+ds-2`	Affected	[CVE-2025-3160]

Original provider fields

{
  "package_releases": [
    {
      "name": "assimp",
      "status": "fixed",
      "release": "sid",
      "version": "6.0.5+ds-1"
    },
    {
      "name": "assimp",
      "status": "fixed",
      "release": "forky",
      "version": "6.0.5+ds-1"
    },
    {
      "name": "assimp",
      "status": "vulnerable",
      "release": "trixie",
      "version": "5.4.3+ds-2"
    },
    {
      "name": "assimp",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "5.2.5~ds0-1"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1102206,
      "name": "assimp",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "6.0.2+ds-1"
    },
    {
      "bug": 1102206,
      "name": "assimp",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "6.0.2+ds-1"
    },
    {
      "bug": 1102206,
      "name": "assimp",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": 1102206,
      "name": "assimp",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "assimp",
      "fixed_version": "not yet fixed",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #1102206]

Publisher notes

[trixie] assimp: Minor issue [bookworm] assimp: Minor issue

OpenFactory catalog packages

L’association des paquets est en cours.

[Debian 12 (Bookworm)]

[assimp-testmodels]Inconnu
Paquet source: [assimp]
Détails (2)
- 5.2.5~ds0-1 · all · bookworm
  Affectée
  dsa · assimp · debian · bookworm; dsa · assimp · debian · 12
- 5.2.5~ds0-1 · all · bookworm
  Affectée
  dsa · assimp · debian · bookworm; dsa · assimp · debian · 12
[assimp-utils]Inconnu
Paquet source: [assimp]
Détails (2)
- 5.2.5~ds0-1+b1 · amd64 · bookworm
  Affectée
  dsa · assimp · debian · bookworm; dsa · assimp · debian · 12
- 5.2.5~ds0-1+b1 · arm64 · bookworm
  Affectée
  dsa · assimp · debian · bookworm; dsa · assimp · debian · 12
[libassimp5]Inconnu
Paquet source: [assimp]
Détails (2)
- 5.2.5~ds0-1+b1 · amd64 · bookworm
  Affectée
  dsa · assimp · debian · bookworm; dsa · assimp · debian · 12
- 5.2.5~ds0-1+b1 · arm64 · bookworm
  Affectée
  dsa · assimp · debian · bookworm; dsa · assimp · debian · 12
[libassimp-dev]Inconnu
Paquet source: [assimp]
Détails (2)
- 5.2.5~ds0-1+b1 · amd64 · bookworm
  Affectée
  dsa · assimp · debian · bookworm; dsa · assimp · debian · 12
- 5.2.5~ds0-1+b1 · arm64 · bookworm
  Affectée
  dsa · assimp · debian · bookworm; dsa · assimp · debian · 12
[libassimp-doc]Inconnu
Paquet source: [assimp]
Détails (2)
- 5.2.5~ds0-1 · all · bookworm
  Affectée
  dsa · assimp · debian · bookworm; dsa · assimp · debian · 12
- 5.2.5~ds0-1 · all · bookworm
  Affectée
  dsa · assimp · debian · bookworm; dsa · assimp · debian · 12
[python3-pyassimp]Inconnu
Paquet source: [assimp]
Détails (2)
- 5.2.5~ds0-1 · all · bookworm
  Affectée
  dsa · assimp · debian · bookworm; dsa · assimp · debian · 12
- 5.2.5~ds0-1 · all · bookworm
  Affectée
  dsa · assimp · debian · bookworm; dsa · assimp · debian · 12

[Debian 13 (Trixie)]

[assimp-testmodels]Inconnu
Paquet source: [assimp]
Détails (2)
- 5.4.3+ds-2 · all · trixie
  Affectée
  dsa · assimp · debian · 13
- 5.4.3+ds-2 · all · trixie
  Affectée
  dsa · assimp · debian · 13
[assimp-utils]Inconnu
Paquet source: [assimp]
Détails (2)
- 5.4.3+ds-2 · amd64 · trixie
  Affectée
  dsa · assimp · debian · 13
- 5.4.3+ds-2 · arm64 · trixie
  Affectée
  dsa · assimp · debian · 13
[libassimp5]Inconnu
Paquet source: [assimp]
Détails (2)
- 5.4.3+ds-2 · amd64 · trixie
  Affectée
  dsa · assimp · debian · 13
- 5.4.3+ds-2 · arm64 · trixie
  Affectée
  dsa · assimp · debian · 13
[libassimp-dev]Inconnu
Paquet source: [assimp]
Détails (2)
- 5.4.3+ds-2 · amd64 · trixie
  Affectée
  dsa · assimp · debian · 13
- 5.4.3+ds-2 · arm64 · trixie
  Affectée
  dsa · assimp · debian · 13
[libassimp-doc]Inconnu
Paquet source: [assimp]
Détails (2)
- 5.4.3+ds-2 · all · trixie
  Affectée
  dsa · assimp · debian · 13
- 5.4.3+ds-2 · all · trixie
  Affectée
  dsa · assimp · debian · 13
[python3-pyassimp]Inconnu
Paquet source: [assimp]
Détails (2)
- 5.4.3+ds-2 · all · trixie
  Affectée
  dsa · assimp · debian · 13
- 5.4.3+ds-2 · all · trixie
  Affectée
  dsa · assimp · debian · 13

Observé: Oct 24, 2026, 11:09:20 PM UTC

Références

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]