Executive brief
Assimp, a widely used library for importing 3D models, is vulnerable to a denial-of-service attack when processing FBX files. An attacker can provide a specially crafted 3D file that forces the library to attempt an impossibly large memory allocation. This results in the application crashing or being terminated, potentially disrupting services that rely on automated 3D model processing.
Technical details
A vulnerability exists in Assimp 6.0.2 within the FBX parser's ParseVectorDataArray() function in FBXParser.cpp. The root cause is the improper validation of binary array metadata; the parser trusts an untrusted 'count' value from the FBX element to size parsing buffers and output vectors. A remote attacker can provide a crafted FBX file with a very large array count, leading to an uncontrolled memory allocation. This typically results in an allocation-size-too-big abort or process termination (Denial of Service). Red Hat has assigned a CVSS score of 7.5, noting the vulnerability is reachable over the network without authentication.
Affected products
- Assimp project Assimp (Open Asset Import Library) 6.0.2
Timeline
- 2026-05-04: disclosed: Initial vulnerability disclosure and CVE assignment.
- 2026-05-04: advisory: Red Hat and CISA-ADP published advisory details.