{"uuid": "459a3142-0f5c-4dda-8825-79b34634b11b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-6120", "type": "seen", "source": "https://gist.github.com/alon710/4b7457cdf2e8aa38f81dadffcaea2c03", "content": "# CVE-2025-6120: CVE-2025-6120: Heap-Based Buffer Overflow in Assimp HL1MDLLoader read_meshes\n\n> **CVSS Score:** 5.3\n> **Published:** 2025-06-16\n> **Full Report:** https://cvereports.com/reports/CVE-2025-6120\n\n## Summary\nCVE-2025-6120 is a critical memory corruption vulnerability in the Open Asset Import Library (Assimp) affecting versions up to and including 5.4.3. The flaw is located in the Half-Life 1 MDL file format loader, specifically within the read_meshes function in HL1MDLLoader.cpp. It arises due to a lack of verification checks on array, bone, skin, or vertex indices parsed directly from a binary stream, resulting in a heap-based buffer overflow or out-of-bounds memory access.\n\n## TL;DR\nA heap-based buffer overflow vulnerability in Assimp's Half-Life 1 MDL parser (<= 5.4.3) allows local attackers to cause denial of service or potentially execute arbitrary code via a malformed model file.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-122 (Heap-based Buffer Overflow)\n- **Attack Vector**: Local / Client File Ingestion\n- **CVSS v3.1 Score**: 5.3 (Medium)\n- **EPSS Score**: 0.0021\n- **Exploit Status**: Proof-of-Concept Available\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Open Asset Import Library (Assimp) <= 5.4.3\n- **Assimp**: <= 5.4.3 (Fixed in: `Not explicitly patched (Tracking issue active)`)\n\n## Mitigation\n\n- Disable the vulnerable Half-Life MDL loader component using CMake compilation flags if legacy formats are not required.\n- Run the asset parsing process within an isolated sandbox environment to minimize system-level exposure.\n\n**Remediation Steps:**\n1. Run the CMake compilation command with the MDL importer disabled: `cmake -DASSIMP_BUILD_MDL_IMPORTER=OFF ..`\n2. Rebuild and distribute the newly compiled binary library across all application environments.\n\n## References\n\n- [GitHub Issue Tracker - Bug Report #6220](https://github.com/assimp/assimp/issues/6220)\n- [GitHub Issue Tracker - Maintainer Response Comment](https://github.com/assimp/assimp/issues/6220#issuecomment-2945018579)\n- [VulDB Entry for CVE-2025-6120](https://vuldb.com/?id.312589)\n- [VulDB CTI Indicators](https://vuldb.com/?ctiid.312589)\n- [VulDB Submission Details](https://vuldb.com/?submit.591235)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2025-6120) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T01:31:18.792529Z"}