CVE-2025-3158: 
NixOS vulnerability analysis and mitigation

A critical heap-based buffer overflow vulnerability (CVE-2025-3158) was discovered in Open Asset Import Library (Assimp) version 5.4.3. The vulnerability affects the UpdateAnimRangeSetup function in the LWO File Handler component, specifically in the file code/AssetLib/LWO/LWOAnimation.cpp. The issue was disclosed on February 25, 2025 (GitHub Issue).

The vulnerability stems from a heap-based buffer overflow in the Assimp::LWO::AnimResolver::UpdateAnimRangeSetup function. The issue occurs when reading out-of-bounds memory from an allocated Assimp::LWO::Key variable. The vulnerability has received a CVSS v4.0 score of 4.8 (Medium) with vector string CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N, and a CVSS v3.1 score of 5.3 (Medium) (NVD).

The vulnerability allows an attacker to potentially execute arbitrary code by manipulating a malformed LWO file. The attack can be launched locally and could lead to unauthorized access, data manipulation, or system compromise (GitHub Issue).

As of the initial disclosure, no official patch has been released for this vulnerability. Users are advised to exercise caution when processing untrusted LWO files and monitor for updates from the Assimp project (NVD).