Executive brief
Assimp is a widely used library that allows software applications to import various 3D model file formats. A flaw in how the library handles FBX files means that a specially crafted 3D model can cause the application using Assimp to crash. This results in a denial of service, potentially disrupting operations for users or services that process automated 3D asset uploads.
Technical details
A NULL pointer dereference (CWE-476) exists in Assimp v.6.0.2 within the FBX importer component. Specifically, the `MeshGeometry::MeshGeometry()` constructor in `FBXMeshGeometry.cpp` processes Layer elements by accessing the first token in a `TokenList` without verifying if the list is empty. An attacker can provide a crafted FBX file containing a Layer element with no tokens, which triggers an unchecked dereference of `tokens[0]`. This leads to a deterministic application crash. The vulnerability requires a user or automated system to attempt to import the malicious FBX file.
Affected products
- Assimp project Assimp (Open Asset Import Library) 6.0.2
Timeline
- 2026-05-01: disclosed: Initial discovery and Gist publication by TaeYong LEE
- 2026-05-04: advisory: CVE-2025-70070 published