Executive brief
fbxcel is a software library used by developers to process FBX 3D model files in the Rust programming language. A vulnerability in how the library handles file headers allows a specially crafted file to crash the application or exhaust system memory. This could lead to a denial-of-service, preventing the software from functioning correctly when processing untrusted 3D assets.
Technical details
A vulnerability exists in the Node Header Handler of fbxcel (specifically in src/pull_parser/v7400/parser.rs and direct.rs) due to improper validation of length-prefix values in FBX files. An attacker can provide a malformed FBX file with a large 'bytelen_attributes' value that causes an arithmetic overflow when calculated against the current offset, or triggers an unchecked large memory allocation (OOM) in DirectLoader::load_binary and DirectLoader::load_string. This is reachable via AnyTree::from_reader. While a pull request (#15) has been submitted to implement checked addition and length validation, it remains unmerged as of the advisory date.
Affected products
- lo48576 fbxcel up to 0.9.0
Timeline
- 2026-06-04: disclosed: Issue reported on GitHub
- 2026-06-06: other: Fix proposed via pull request #15
- 2026-07-09: advisory: CVE published