CVE-2025-3196: 
Python vulnerability analysis and mitigation

A critical stack-based buffer overflow vulnerability (CVE-2025-3196) was discovered in Open Asset Import Library Assimp version 5.4.3. The vulnerability affects the Assimp::MD2Importer::InternReadFile function in the library code/AssetLib/MD2/MD2Loader.cpp component of the Malformed File Handler. The vulnerability was disclosed on March 27, 2025, and requires local access to exploit (GitHub Issue).

The vulnerability occurs in the MD2Importer::InternReadFile function when processing certain malformed files. The function lacks proper validation of the iLen parameter before calling memcpy, which can result in a write operation beyond the allocated memory. The issue arises from improper string truncation in pcSkins->name generation, potentially leading to an oversized iLen value. The vulnerability has a CVSS v3.1 base score of 5.3 (MEDIUM) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L (NVD).

The exploitation of this vulnerability can lead to stack-based buffer overflow, potentially resulting in application crashes and arbitrary code execution in the context of the current process. The attack requires local access to be initiated (Red Hat).

The vulnerability has been publicly disclosed with proof-of-concept code available. It requires local access to exploit, and detailed reproduction steps have been published. The exploit has been confirmed to trigger a segmentation fault during the execution of post-processing logic (GitHub Issue).

The vulnerability has been marked as fixed-upstream in the Debian bug tracking system. It is recommended to upgrade the affected component when patches become available. For Red Hat Enterprise Linux 9, the fix has been deferred for the qt5-qt3d package (Red Hat).