affected:
- ecosystem_specific: {}
  package:
    ecosystem: PyPI
    name: pyassimp
    purl: pkg:pypi/pyassimp
  ranges:
  - events:
    - introduced: '0'
    - last_affected: 5.4.3
    type: ECOSYSTEM
  versions:
  - '0.1'
  - '3.3'
  - 4.1.1
  - 4.1.2
  - 4.1.3
  - 4.1.4
  - 5.2.5
aliases:
- CVE-2025-5169
details: A vulnerability classified as problematic has been found in Open Asset Import
  Library Assimp 5.4.3. This affects the function MDLImporter::InternReadFile_3DGS_MDL345
  of the file assimp/code/AssetLib/MDL/MDLLoader.cpp. The manipulation leads to out-of-bounds
  read. Local access is required to approach this attack. The exploit has been disclosed
  to the public and may be used. The project decided to collect all Fuzzer bugs in
  a main-issue to address them in the future.
id: PYSEC-2025-176
modified: '2026-05-21T14:54:39.847998Z'
published: '2025-05-26T05:15:19.387Z'
references:
- type: ADVISORY
  url: https://vuldb.com/?id.310257
- type: ADVISORY
  url: https://vuldb.com/?submit.578004
- type: REPORT
  url: https://github.com/assimp/assimp/issues/6128
- type: REPORT
  url: https://vuldb.com/?ctiid.310257
- type: EVIDENCE
  url: https://github.com/assimp/assimp/issues/6171
- type: EVIDENCE
  url: https://github.com/user-attachments/files/20208891/reproducer.zip
severity:
- score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  type: CVSS_V3