Executive brief
Assimp, a widely used library for importing 3D models, contains a vulnerability that can be triggered by processing a specially crafted FBX file. An attacker can provide a file that forces the library to attempt an extremely large memory allocation, leading to a program crash or system instability. This results in a denial of service for any application using the library to process untrusted 3D assets.
Technical details
A vulnerability exists in Assimp 6.0.2 within the FBX importer component, specifically in the FBXConverter::ConvertMeshMultiMaterial method in FBXConverter.cpp. The issue stems from a lack of validation for face index counts when summing them into the count_vertices variable. An attacker can provide a crafted FBX file with oversized face index counts, causing the library to attempt a massive memory allocation for the mVertices array. This leads to an out-of-memory (OOM) condition or process termination. The attack is reachable remotely if an application uses Assimp to parse untrusted user-supplied FBX files.
Affected products
- Assimp project Assimp (Open Asset Import Library) 6.0.2
Timeline
- 2026-05-04: advisory: NVD publication date