CVE-2025-3016: 
NixOS vulnerability analysis and mitigation

A vulnerability was discovered in Open Asset Import Library (Assimp) version 5.4.3, identified as CVE-2025-3016. The issue affects the function Assimp::MDLImporter::ParseTextureColorData in the MDL File Handler component (code/AssetLib/MDL/MDLMaterialLoader.cpp). The vulnerability was disclosed on March 31, 2025 (NVD).

The vulnerability stems from improper validation of texture dimensions (mWidth/mHeight parameters) in the MDL File Handler component. When processing texture color data, the function fails to properly validate texture size limits before memory allocation, which can lead to resource consumption issues. The vulnerability has received a CVSS v4.0 base score of 5.3 MEDIUM (NVD).

If exploited, this vulnerability could allow an attacker to cause a denial of service condition through excessive resource consumption. This can occur when processing malformed MDL files with manipulated texture dimensions, potentially leading to out-of-memory conditions (Github Issue).

The vulnerability has been fixed in version 6.0 through the implementation of texture size limits. The patch (commit 5d2a7482312db2e866439a8c05a07ce1e718bed1) introduces a maximum texture size limit of 4096 pixels for both width and height (Github Commit).