CVE-2025-2152 is a medium severity heap based buffer overflow (CVSS 6.3) in the Open Asset Import Library, Assimp 5.4.3. It sits in Assimp::BaseImporter::ConvertToUTF8 and is reached by opening a malformed file. I could not confirm a fixed release, so check the Assimp issue and releases.
What's affected
- Product: Open Asset Import Library (Assimp)
- Affected version: 5.4.3
- Vulnerable function:
Assimp::BaseImporter::ConvertToUTF8inBaseImporter.cpp - Fixed version: not confirmed. The upstream issue shows as closed, so read it and the project's release notes
- CVSS: 6.3 (Medium), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Published: 2025-03-10
The upstream report was found by a fuzzer. It describes an out of bounds read in a character conversion routine that can crash the application, and the record calls the weakness a heap based buffer overflow. The vector needs user interaction, in practice opening a crafted model file. The CISA Known Exploited Vulnerabilities flag is false for this CVE, and none of the pages I read report active exploitation.
How to check if you're exposed
Assimp is a library, so it usually reaches you through another package. Look for it in system packages, language packages and bundled copies.
# Debian or Ubuntu
dpkg -l | grep -i assimp
# macOS Homebrew
brew list --versions assimp
# vcpkg
vcpkg list | grep -i assimp
# Python bindings
pip list 2>/dev/null | grep -i assimp
# bundled copies in a source tree
find . -iname "*assimp*" -maxdepth 4 2>/dev/null
Anything that reports 5.4.3 is in scope. Also check applications that ship their own copy, such as game engines, viewers and converters, since those will not show up in system package lists. Our free in-browser dependency scan can read a manifest or lockfile and tell you which components include Assimp and in which version.
What to do now
- Find every place Assimp 5.4.3 is installed or bundled, including inside applications you build.
- Read the upstream issue and the project's release notes to confirm which release or commit fixes the problem, then upgrade.
- Until you upgrade, avoid loading model files from untrusted sources with affected builds, especially in services that convert uploaded files.
- Run conversion services with limited privileges and memory limits so a crash does not take more with it.
- Rebuild and redeploy anything that bundles the library, since updating the system package does not change a bundled copy.
Why it matters
The record lists CWE-119, CWE-122 and CWE-787: a heap buffer problem found in a routine that converts text encodings. Handling text from files is a classic source of bugs, because the file controls the lengths and the code has to check every one of them.
For most teams the question is whether the code path is actually reachable. A desktop tool that opens only your own models carries less risk than a web service that converts files users upload. That is where reachability analysis helps, since it separates a library that is installed from one whose vulnerable function your code can actually call. The demo below shows the idea.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a fixed release?
I could not confirm one. The upstream issue shows as closed, so check it and the release notes before you upgrade.
Who is most at risk?
Services that convert files uploaded by outsiders, since a crafted file can reach the vulnerable code.
Sources
Last reviewed: 19 October 2026.
