A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. Affected by this issue is the function Assimp::LWO::AnimResolver::UpdateAnimRangeSetup of the file code/AssetLib/LWO/LWOAnimation.cpp of the component LWO File Handler. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:12842 advisory.

    * assimp: Open Asset Import Library Assimp LWO File LWOAnimation.cpp UpdateAnimRangeSetup heap-based     overflow (CVE-2025-3158)

    * assimp: Open Asset Import Library Assimp ASE File ASEParser.cpp ParseLV4MeshBonesVertices heap-based     overflow (CVE-2025-3159)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:15463 advisory.

    Qt 3D provides functionality for near-realtime simulation systems with support for 2D and 3D rendering in     both Qt C++ and Qt Quick applications).

    Security Fix(es):

    * assimp: Open Asset Import Library Assimp LWO File LWOAnimation.cpp UpdateAnimRangeSetup heap-based     overflow (CVE-2025-3158)

    * assimp: Open Asset Import Library Assimp ASE File ASEParser.cpp ParseLV4MeshBonesVertices heap-based     overflow (CVE-2025-3159)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:15407 advisory.

    Qt 3D provides functionality for near-realtime simulation systems with support for 2D and 3D rendering in     both Qt C++ and Qt Quick applications).

    Security Fix(es):

    * assimp: Open Asset Import Library Assimp LWO File LWOAnimation.cpp UpdateAnimRangeSetup heap-based     overflow (CVE-2025-3158)

    * assimp: Open Asset Import Library Assimp ASE File ASEParser.cpp ParseLV4MeshBonesVertices heap-based     overflow (CVE-2025-3159)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:15347 advisory.

    Qt 3D provides functionality for near-realtime simulation systems with support for 2D and 3D rendering in     both Qt C++ and Qt Quick applications).

    Security Fix(es):

    * assimp: Open Asset Import Library Assimp LWO File LWOAnimation.cpp UpdateAnimRangeSetup heap-based     overflow (CVE-2025-3158)

    * assimp: Open Asset Import Library Assimp ASE File ASEParser.cpp ParseLV4MeshBonesVertices heap-based     overflow (CVE-2025-3159)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp     5.4.3. Affected by this issue is the function Assimp::LWO::AnimResolver::UpdateAnimRangeSetup of the file     code/AssetLib/LWO/LWOAnimation.cpp of the component LWO File Handler. The manipulation leads to heap-based     buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to     the public and may be used. (CVE-2025-3158)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-12842 advisory.

    [5.15.9-2]
    - Assimp: Fix heap-based overflow in Assimp::LWO::AnimResolver::UpdateAnimRangeSetup       Resolves: RHEL-105000
    - Assimp: Fix heap-based overflow in Assimp::ASE::Parser::ParseLV4MeshBonesVertices       Resolves: RHEL-105005

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:12842 advisory.

    Qt 3D provides functionality for near-realtime simulation systems with support for 2D and 3D rendering in     both Qt C++ and Qt Quick applications).

    Security Fix(es):

    * assimp: Open Asset Import Library Assimp LWO File LWOAnimation.cpp UpdateAnimRangeSetup heap-based     overflow (CVE-2025-3158)

    * assimp: Open Asset Import Library Assimp ASE File ASEParser.cpp ParseLV4MeshBonesVertices heap-based     overflow (CVE-2025-3159)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of qt5-qt3d installed on the remote host is prior to 5.15.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2903 advisory.

    A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3.
    This affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp     of the component CSM File Handler. The manipulation leads to out-of-bounds write. It is possible to     initiate the attack remotely. The exploit has been disclosed to the public and may be used.
    (CVE-2025-2750)

    A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic.
    This vulnerability affects the function Assimp::CSMImporter::InternReadFile of the file     code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. The manipulation of the argument na     leads to out-of-bounds read. The attack can be initiated remotely. The exploit has been disclosed to the     public and may be used. (CVE-2025-2751)

    A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This     vulnerability affects the function AI_MD5_PARSE_STRING_IN_QUOTATION of the file     code/AssetLib/MD5/MD5Parser.cpp of the component MD5 File Handler. The manipulation of the argument data     leads to heap-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed     to the public and may be used. (CVE-2025-2757)

    A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp     5.4.3. Affected by this issue is the function Assimp::LWO::AnimResolver::UpdateAnimRangeSetup of the file     code/AssetLib/LWO/LWOAnimation.cpp of the component LWO File Handler. The manipulation leads to heap-based     buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to     the public and may be used. (CVE-2025-3158)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
269238	RockyLinux 9 : qt5-qt3d (RLSA-2025:12842)	Nessus	Rocky Linux Local Security Checks	medium
261693	RHEL 9 : qt5-qt3d (RHSA-2025:15463)	Nessus	Red Hat Local Security Checks	medium
261666	RHEL 9 : qt5-qt3d (RHSA-2025:15407)	Nessus	Red Hat Local Security Checks	medium
261420	RHEL 9 : qt5-qt3d (RHSA-2025:15347)	Nessus	Red Hat Local Security Checks	medium
250134	Linux Distros Unpatched Vulnerability : CVE-2025-3158	Nessus	Misc.	medium
244359	Oracle Linux 9 : qt5-qt3d (ELSA-2025-12842)	Nessus	Oracle Linux Local Security Checks	medium
243549	RHEL 9 : qt5-qt3d (RHSA-2025:12842)	Nessus	Red Hat Local Security Checks	medium
240452	Amazon Linux 2 : qt5-qt3d (ALAS-2025-2903)	Nessus	Amazon Linux Local Security Checks	medium

Detections

Analytics

CVE-2025-3158

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium