CVE-2025-2591CWE-369CWE-404

Open Asset Import Library Assimp MDLLoader.cpp InternReadFile_Quake1 divide by zero

Medium · published March 21, 2025

CVSS v4.0
5.3
EPSS
1%
Percentile
50.8
In the wild
Unconfirmed
What it is

A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function MDLImporter::InternReadFile_Quake1 of the file code/AssetLib/MDL/MDLLoader.cpp. The manipulation of the argument skinwidth/skinheight leads to divide by zero. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is identified as ab66a1674fcfac87aaba4c8b900b315ebc3e7dbd. It is recommended to apply a patch to fix this issue.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00656 · 50.8th percentile
Weaknesses
CWE-369 · Divide By Zero; CWE-404 · Improper Resource Shutdown or Release
Published
2025-03-21T13:31Z
EPSS history
Timeline
  • 21 MAR 13:31Z
    Open Asset Import Library Assimp MDLLoader.cpp InternReadFile_Quake1 divide by zero
    cvelistv5