CVE-2025-11274

Open Asset Import Library Assimp Q3DLoader.cpp InternReadFile allocation of resources

State: Published
Severity: 4.8 Medium
Published: Oct 5, 2025
Updated: Feb 24, 2026
Reserved: Oct 4, 2025

Description

A vulnerability was determined in Open Asset Import Library Assimp 6.0.2. Affected is the function Q3DImporter::InternReadFile of the file assimp/code/AssetLib/Q3D/Q3DLoader.cpp. This manipulation causes allocation of resources. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized.

Scores

CVSS	Score	Vector	Source
4.0	4.8 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	3.3 Low	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R	VulDB
3.0	3.3 Low	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R	VulDB
2.0	1.7 Low	AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-770 Allocation of Resources
CWE-400 Resource Consumption

Affected Products

Product	Versions
AssimpOpen Asset Import Library	6.0.2Affected

References

VDB-327008 | Open Asset Import Library Assimp Q3DLoader.cpp InternReadFile allocation of resourcesvdb-entrytechnical-description
VDB-327008 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
Submit #658075 | Open Asset Import Library Assimp 6.0.2 / master commit 0581ed5 Uncontrolled Memory Allocationthird-party-advisory
https://github.com/assimp/assimp/issues/6356issue-tracking
https://github.com/user-attachments/files/22407575/poc.zipexploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.