CVE-2025-15666 is a heap-based buffer overflow vulnerability in Assimp up to version 5.4.3. It affects the function Assimp::SceneCombiner::Copy in code/Common/SceneCombiner.cpp, where improper handling of width and height arguments leads to memory corruption. Exploitation requires local access with low privileges and no user interaction. The vulnerability has been publicly disclosed but no known exploits are reported in the wild. The issue is tracked via Assimp's issue #6128. No official patch or remediation level is currently documented.

Successful exploitation of this vulnerability could lead to heap memory corruption, potentially causing application crashes or arbitrary code execution under the privileges of the local user. Since the attack vector is local and requires low privileges, the impact is limited to users with local access. There is no indication of remote exploitation or widespread active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory or issue #6128 for current remediation guidance. Until an official fix is available, restrict local access to trusted users only to reduce risk. Monitor the Assimp project for updates addressing this vulnerability.