CVE-2025-2591

Katalog CVE

CVSS 5.5 · Medium EPSS 0,64%

Kerentanan Divide By Zero pada assimp. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function MDLImporter::InternReadFile_Quake1 of the file code/AssetLib/MDL/MDLLoader.cpp. The manipulation of the argument skinwidth/skinheight leads to divide by zero. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is identified as ab66a1674fcfac87aaba4c8b900b315ebc3e7dbd. It is recommended to apply a patch to fix this issue.

Rincian

Terbit di NVD

21 Maret 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-369: Divide By Zero
CWE-404: Improper Resource Shutdown or Release

EPSS (30 hari)

0,64% peluang dieksploitasi; lebih tinggi dari 49,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/assimp/assimp/pull/6047 patch
• https://github.com/assimp/assimp/pull/6047/commits/ab66a1674fcfac87aaba4c8b900b315ebc3e7dbd patch
• https://vuldb.com/?id.300574 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.517781 advisory pihak ketiga · vdb entry
• https://github.com/assimp/assimp/issues/6009 exploit · issue tracking
• https://github.com/assimp/assimp/issues/6009#issue-2877367021 exploit · issue tracking
• https://vuldb.com/?ctiid.300574 permissions required · vdb entry