The vulnerability resides in the Assimp::SceneCombiner::Copy operation, which copies model dimensions without adequate bounds checks, causing a heap‑based buffer overflow when an attacker supplies crafted width/height values. The flaw is a classic heap‑overflow identified by CWE‑119, CWE‑122, and CWE‑787 and can corrupt memory on the local machine. An attacker who can execute code locally may cause a segmentation fault, crash the application or potentially gain code execution if a suitable exploitation vector is derived from the corrupted heap region.

Open Asset Import Library Assimp versions up to and including 5.4.3 are affected. This includes any software that embeds Assimp 5.4.3 or earlier for model file handling, such as games and CAD tools that rely on the library. The vulnerability was discovered in the common scene combiner component used across all platforms supported by Assimp.

The CVSS base score is 4.8, signifying moderate severity, and the EPSS score is < 1%, indicating a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, but the exploit has been publicly disclosed and may be used. Because the overflow occurs during normal model file processing, any software that accepts user‑supplied files can be attacked if a local attacker can arrive at the host or supply files through an exposed service.