Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-5167
CVE-2025-5167:
Linux Debian vulnerability analysis and mitigation
Overview
A vulnerability was discovered in Open Asset Import Library (Assimp) version 5.4.3, identified as CVE-2025-5167. The vulnerability affects the LWOImporter::GetS0 function in the library file assimp/code/AssetLib/LWO/LWOLoader.h, where an out-of-bounds read can occur. The issue was discovered through fuzzing and requires local access to exploit (GitHub Issue).
Technical details
The vulnerability is an out-of-bounds read in the LWOImporter::GetS0 function. The function contains a check for buffer size and warns "LWO: Invalid file, string is too long", but despite this warning, it still includes one past-the-end byte in the string output if the data is not null-terminated. The issue has been assigned a CVSS v3.1 score of 3.3 (LOW) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L and is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-125 (Out-of-bounds Read) (NVD).
Impact
The vulnerability has a low severity impact, primarily affecting the availability of the system. The out-of-bounds read could potentially cause application crashes or unexpected behavior when processing malformed LWO files (VulDB).
Mitigation and workarounds
The project has acknowledged the issue and has decided to collect all fuzzer bugs in a main tracking issue for future addressing. Currently, there is no official patch available. Users are advised to monitor the project's GitHub repository for updates (GitHub Issue).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management