Executive brief
Assimp is a widely used library for importing 3D models into various applications and games. A vulnerability in its FBX file importer allows a remote attacker to crash any application that attempts to process a specially crafted 3D model file. This could lead to a denial of service, disrupting operations or crashing software used for 3D rendering and asset management.
Technical details
An out-of-bounds read (CWE-125) exists in Assimp v.6.0.2 within the FBX importer's multi-material mesh conversion logic. The vulnerability is located in `FBXConverter.cpp` inside the `Assimp::FBX::FBXConverter::ConvertMeshMultiMaterial` function. The root cause is a failure to validate that the material-index array (`mindices`) and the face-count array (`faces`) have equal lengths before iterating through them in lockstep. An attacker can provide a crafted FBX file with mismatched array lengths, causing the face-count iterator to advance past the end of its buffer. This results in an application crash (Denial of Service) when the library attempts to read the out-of-bounds memory. Exploitation requires a user to import the malicious FBX file using the affected library.
Affected products
- Assimp project Assimp (Open Asset Import Library) 6.0.2
Timeline
- 2026-05-01: disclosed: Initial discovery and public reference published by researcher.
- 2026-05-04: advisory: CVE-2025-70072 published.