EUVD-2025-209620CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Lifecycle Timeline
5DescriptionNVD
An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXMeshGeometry.cpp, MeshGeometry::MeshGeometry()
AnalysisAI
Denial of service vulnerability in Assimp 6.0.2 via null pointer dereference in FBXMeshGeometry.cpp MeshGeometry constructor allows remote attackers to crash applications processing malicious FBX files. Requires user interaction (opening/processing a crafted file) but affects any application using the vulnerable library version. Publicly available exploit code exists; CVSS 6.5 reflects network attack vector with user interaction requirement.
Technical ContextAI
Assimp (Open Asset Import Library) is a 3D model import library supporting multiple formats including FBX. The vulnerability exists in the FBX geometry processing code (FBXMeshGeometry.cpp), specifically in the MeshGeometry constructor which handles mesh data parsing. A null pointer dereference (CWE-476) occurs during FBX mesh geometry initialization, indicating the code fails to validate or check for null pointers before dereferencing them. This typically happens when parsing specially crafted FBX files with malformed mesh geometry data that causes expected structures to be absent or improperly initialized.
RemediationAI
Upgrade Assimp to a patched version newer than 6.0.2 if available from the project repository (http://assimp.com). As no specific patched version number is confirmed in provided data, verify the latest stable release on the official Assimp GitHub or website. Until patching is possible, implement file validation: restrict FBX file processing to known-good files from trusted sources, disable automatic FBX loading in user-facing applications, and run Assimp-dependent services in sandboxed environments with resource limits (memory caps, process timeout) to contain denial of service impact. Server-side applications should implement upload validation to reject suspicious FBX files before parsing. Note: these workarounds do not eliminate the vulnerability but reduce exploitability in production environments.
More from same product – last 7 days
Command injection in the shell-quote npm package allows attackers who can influence object-token inputs to inject arbitr
Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module allows unauthenticated remote attackers
Vendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today