Source: assimp Version: 5.4.3+ds-2 Severity: important Tags: security upstream Forwarded: https://github.com/assimp/assimp/issues/6219 X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for assimp. CVE-2025-6119[0]: | A vulnerability classified as critical has been found in Open Asset | Import Library Assimp up to 5.4.3. Affected is the function | Assimp::BVHLoader::ReadNodeChannels in the library | assimp/code/AssetLib/BVH/BVHLoader.cpp. The manipulation of the | argument pNode leads to use after free. Attacking locally is a | requirement. The exploit has been disclosed to the public and may be | used. The project decided to collect all Fuzzer bugs in a main-issue | to address them in the future. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2025-6119 https://www.cve.org/CVERecord?id=CVE-2025-6119 [1] https://github.com/assimp/assimp/issues/6219 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
