The vulnerability resides in the Assimp::SceneCombiner::Copy operation, which copies model dimensions without adequate bounds checks, causing a heap‑based buffer overflow when an attacker supplies crafted width/height values. The flaw is a classic heap overflow identified by CWE‑119 and CWE‑122 and can corrupt memory on the local machine. An attacker who can execute code locally may cause a segmentation fault, crash the application or potentially gain code execution if a suitable exploitation vector is derived from the corrupted heap region.

Open Asset Import Library Assimp versions up to and including 5.4.3 are affected. This includes any software that embeds Assimp 5.4.3 or earlier for model file handling, such as games and CAD tools that rely on the library. The vulnerability was discovered in the common scene combiner component used across all platforms supported by Assimp.

The CVSS base score is 4.8, signifying moderate severity, and the EPSS score is not available, indicating no public data on likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, but the exploit has been publicly disclosed and requires only local access to the target system. Because the overflow occurs during normal model file processing, any software that accepts user‑supplied models can be targeted by file‑based attacks if a local attacker can arrive at the host or supply files through an exposed service.