Is CVE-2025-15666 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-15666 being exploited in the wild.

How severe is CVE-2025-15666?

Medium severity, with a CVSS score of 5.3, published 1 July 2026.

Which products and versions are affected?

Assimp Asset Import Library up to 5.4.3.

Is there a fix for CVE-2025-15666?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-15666 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2025-15666?

Check whether you run Assimp Asset Import Library at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-15666: Open Asset Import Library Assimp heap overflow in SceneCombiner::Copy

CVE-2025-15666 · Severity: medium · CVSS 5.3 · Published 2026-07-01

Assimp is a widely used library for importing and processing 3D model files in various formats. A security flaw in its model handling component could allow a local attacker to cause a system crash or potentially execute unauthorized code by providing a specially crafted 3D model file. This could lead to service disruptions or unauthorized access to data on the affected system.

Technologies: Assimp Asset Import Library. Vendors: Assimp.

Quick answers

Is CVE-2025-15666 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-15666 being exploited in the wild.
How severe is CVE-2025-15666?: Medium severity, with a CVSS score of 5.3, published 1 July 2026.
Which products and versions are affected?: Assimp Asset Import Library up to 5.4.3.
Is there a fix for CVE-2025-15666?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-15666 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2025-15666?: Check whether you run Assimp Asset Import Library at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow vulnerability exists in the Assimp::SceneCombiner::Copy function within code/Common/SceneCombiner.cpp of the Open Asset Import Library (Assimp). The flaw is triggered by improper manipulation of width and height arguments during model file processing. An attacker with local access can exploit this by providing a malicious model file, leading to memory corruption. This can result in a denial-of-service (crash) or potentially arbitrary code execution. The vulnerability affects versions up to 5.4.3 and has been publicly disclosed.

Affected products

Open Asset Import Library Assimp up to 5.4.3

Timeline

2026-07-01: advisory: NVD publication date
2026-07-01: disclosed: Public disclosure of the exploit

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.