An update for assimp is now available for openEuler-24.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-3105 Final 1.0 1.0 2026-07-24 Initial 2026-07-24 2026-07-24 openEuler SA Tool V1.0 2026-07-24 assimp security update An update for assimp is now available for openEuler-24.03-LTS-SP4 Assimp is a library to load and process geometric scenes from various data formats. Assimp aims to provide a full asset conversion pipeline for use in game engines and real-time rendering systems of any kind, but is not limited to this purpose. Security Fix(es): Buffer Overflow vulnerability exists in Assimp versions up to 6.0.2 in the FBX Importer. The vulnerability occurs in aiMaterial::AddBinaryProperty, where a property key string from a crafted FBX file is copied into a fixed-size heap buffer using strcpy() without runtime length validation(CVE-2025-70067) An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXConverter.cpp and ConvertMeshMultiMaterial() method(CVE-2025-70069) An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXMeshGeometry.cpp, MeshGeometry::MeshGeometry()(CVE-2025-70070) An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXParser.cpp, ParseVectorDataArray()(CVE-2025-70071) An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXConverter.cpp, FBXConverter::ConvertMeshMultiMaterial() components(CVE-2025-70072) A vulnerability was found in Assimp up to 6.0.4. This affects the function glTFCommon::CopyValue in the library glTFCommon.h of the component 4x4 Matrix Parser. Performing a manipulation results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been made public and could be used. The project tagged the reported issue as bug.(CVE-2026-10200) A vulnerability was found in Assimp up to 6.0.4 and classified as critical.Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.Impacted is confidentiality, integrity, and availability.The exploit is available at github.com. It is declared as proof-of-concept. The project tagged the reported issue as bug.There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2026-10232) A flaw has been found in Open Asset Import Library Assimp up to 6.0.5. Impacted is the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. This manipulation causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been published and may be used. Patch name: eb84eec580d3f4ba2f0fd87409b7d0744620f11e. Applying a patch is the recommended action to fix this issue.(CVE-2026-14610) An update for assimp is now available for master/openEuler-20.03-LTS-SP4/openEuler-22.03-LTS-SP4/openEuler-24.03-LTS/openEuler-24.03-LTS-Next/openEuler-24.03-LTS-SP1/openEuler-24.03-LTS-SP3/openEuler-24.03-LTS-SP4. openEuler Security has rated this update as having a security impact of critical. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Critical assimp https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3105 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2025-70067 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2025-70069 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2025-70070 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2025-70071 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2025-70072 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-10200 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-10232 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-14610 https://nvd.nist.gov/vuln/detail/CVE-2025-70067 https://nvd.nist.gov/vuln/detail/CVE-2025-70069 https://nvd.nist.gov/vuln/detail/CVE-2025-70070 https://nvd.nist.gov/vuln/detail/CVE-2025-70071 https://nvd.nist.gov/vuln/detail/CVE-2025-70072 https://nvd.nist.gov/vuln/detail/CVE-2026-10200 https://nvd.nist.gov/vuln/detail/CVE-2026-10232 https://nvd.nist.gov/vuln/detail/CVE-2026-14610 openEuler-24.03-LTS-SP4 assimp-5.3.1-20.oe2403sp4.aarch64.rpm assimp-debuginfo-5.3.1-20.oe2403sp4.aarch64.rpm assimp-debugsource-5.3.1-20.oe2403sp4.aarch64.rpm assimp-devel-5.3.1-20.oe2403sp4.aarch64.rpm assimp-5.3.1-20.oe2403sp4.src.rpm assimp-5.3.1-20.oe2403sp4.x86_64.rpm assimp-debuginfo-5.3.1-20.oe2403sp4.x86_64.rpm assimp-debugsource-5.3.1-20.oe2403sp4.x86_64.rpm assimp-devel-5.3.1-20.oe2403sp4.x86_64.rpm assimp-help-5.3.1-20.oe2403sp4.noarch.rpm python3-assimp-5.3.1-20.oe2403sp4.noarch.rpm Buffer Overflow vulnerability exists in Assimp versions up to 6.0.2 in the FBX Importer. The vulnerability occurs in aiMaterial::AddBinaryProperty, where a property key string from a crafted FBX file is copied into a fixed-size heap buffer using strcpy() without runtime length validation 2026-07-24 CVE-2025-70067 openEuler-24.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H assimp security update 2026-07-24 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3105 An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXConverter.cpp and ConvertMeshMultiMaterial() method 2026-07-24 CVE-2025-70069 openEuler-24.03-LTS-SP4 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H assimp security update 2026-07-24 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3105 An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXMeshGeometry.cpp, MeshGeometry::MeshGeometry() 2026-07-24 CVE-2025-70070 openEuler-24.03-LTS-SP4 Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H assimp security update 2026-07-24 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3105 An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXParser.cpp, ParseVectorDataArray() 2026-07-24 CVE-2025-70071 openEuler-24.03-LTS-SP4 Medium 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H assimp security update 2026-07-24 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3105 An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXConverter.cpp, FBXConverter::ConvertMeshMultiMaterial() components 2026-07-24 CVE-2025-70072 openEuler-24.03-LTS-SP4 Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H assimp security update 2026-07-24 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3105 A vulnerability was found in Assimp up to 6.0.4. This affects the function glTFCommon::CopyValue in the library glTFCommon.h of the component 4x4 Matrix Parser. Performing a manipulation results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been made public and could be used. The project tagged the reported issue as bug. 2026-07-24 CVE-2026-10200 openEuler-24.03-LTS-SP4 Medium 5.3 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L assimp security update 2026-07-24 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3105 A vulnerability was found in Assimp up to 6.0.4 and classified as critical.Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.Impacted is confidentiality, integrity, and availability.The exploit is available at github.com. It is declared as proof-of-concept. The project tagged the reported issue as bug.There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product. 2026-07-24 CVE-2026-10232 openEuler-24.03-LTS-SP4 Low 1.9 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X assimp security update 2026-07-24 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3105 A flaw has been found in Open Asset Import Library Assimp up to 6.0.5. Impacted is the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. This manipulation causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been published and may be used. Patch name: eb84eec580d3f4ba2f0fd87409b7d0744620f11e. Applying a patch is the recommended action to fix this issue. 2026-07-24 CVE-2026-14610 openEuler-24.03-LTS-SP4 Medium 5.3 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L assimp security update 2026-07-24 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3105