affected:
- ecosystem_specific: {}
  package:
    ecosystem: PyPI
    name: pyassimp
    purl: pkg:pypi/pyassimp
  ranges:
  - events:
    - introduced: '0'
    - last_affected: 5.4.3
    type: ECOSYSTEM
  versions:
  - '0.1'
  - '3.3'
  - 4.1.1
  - 4.1.2
  - 4.1.3
  - 4.1.4
  - 5.2.5
aliases:
- CVE-2025-5166
details: A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has
  been classified as problematic. Affected is the function MDCImporter::InternReadFile
  of the file assimp/code/AssetLib/MDC/MDCLoader.cpp of the component MDC File Parser.
  The manipulation of the argument pcVerts leads to out-of-bounds read. It is possible
  to launch the attack on the local host. The exploit has been disclosed to the public
  and may be used. The project decided to collect all Fuzzer bugs in a main-issue
  to address them in the future.
id: PYSEC-2025-173
modified: '2026-05-21T14:54:39.678573Z'
published: '2025-05-26T04:15:28.370Z'
references:
- type: ADVISORY
  url: https://vuldb.com/?id.310254
- type: ADVISORY
  url: https://vuldb.com/?submit.578001
- type: REPORT
  url: https://github.com/assimp/assimp/issues/6128
- type: REPORT
  url: https://vuldb.com/?ctiid.310254
- type: EVIDENCE
  url: https://github.com/assimp/assimp/issues/6168
- type: EVIDENCE
  url: https://github.com/user-attachments/files/20208318/reproducer.zip
severity:
- score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  type: CVSS_V3