Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-5200
CVE-2025-5200:
Linux Debian vulnerability analysis and mitigation
Overview
A vulnerability (CVE-2025-5200) has been identified in Open Asset Import Library Assimp version 5.4.3. The issue affects the MDLImporter::InternReadFile_Quake1 function in the file assimp/code/AssetLib/MDL/MDLLoader.cpp. This vulnerability is classified as an out-of-bounds read vulnerability that can be triggered locally. The vulnerability was discovered and disclosed on May 26, 2025 (VulDB).
Technical details
The vulnerability manifests as a heap buffer overflow in two locations within the MDLImporter::InternReadFile_Quake1 function. The first instance occurs at line 452 where pcFrames->type is accessed out of bounds, and the second instance is at lines 457-459 where szCurrent is accessed beyond its allocated memory. The vulnerability has been assigned a CVSS 3.1 Base Score of 3.3 (LOW) with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, and a CVSS 4.0 score of 4.8 (MEDIUM) (VulDB, GitHub Issue).
Impact
The vulnerability affects the availability of the system through out-of-bounds read operations. When exploited, it can lead to memory access violations and potential program crashes. The impact is limited to local attacks and does not affect confidentiality or integrity of the system (VulDB).
Mitigation and workarounds
Currently, there are no official fixes or mitigations available for this vulnerability. The project team has acknowledged the issue and plans to address it along with other Fuzzer-discovered bugs in the future (VulDB).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management