CVE-2025-2591: Open Asset Import Library Assimp MDLLoader.cpp InternReadFile_Quake1 divide by zero
A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function MDLImporter::InternReadFileQuake1 of the file code/AssetLib/MDL/MDLLoader.cpp. The manipulation of the argument skinwidth/skinheight leads to divide by zero. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is identified as ab66a1674fcfac87aaba4c8b900b315ebc3e7dbd. It is recommended to apply a patch to fix this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Open Asset Import Library Assimpto a version that resolves this vulnerability.Fixed in 5.4.3Patch ab66a1674fcfac87aaba4c8b900b315ebc3e7dbd - Compensating control
Limit remote access to any service/workflow that parses untrusted model files (e.g., Quake MDL) to reduce exposure, since the issue can be initiated remotely.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-2591?
CVE-2025-2591 is classified as problematic due to its potential impact on application stability.
What software is affected by CVE-2025-2591?
CVE-2025-2591 affects Open Asset Import Library Assimp version 5.4.3.
How do I fix CVE-2025-2591?
To fix CVE-2025-2591, update Open Asset Import Library Assimp to the latest version that resolves this vulnerability.
What component of Open Asset Import Library is vulnerable in CVE-2025-2591?
CVE-2025-2591 affects the function MDLImporter::InternReadFile_Quake1 in the file MDLLoader.cpp.
What kind of issue does CVE-2025-2591 introduce?
CVE-2025-2591 introduces a vulnerability that can lead to a divide error in the processing of skinwidth/skinheight parameters.