A buffer overflow exists in the Assimp library’s FBX Importer in the aiMaterial::AddBinaryProperty function where a property key string from a crafted FBX file is copied into a fixed‑size heap buffer by strcpy() without runtime length validation. This unchecked copy can corrupt memory on the heap; while the CVE data does not state the exact consequence, it is strongly implied that such an overflow could lead to arbitrary code execution or memory corruption. The description explicitly identifies the flaw, but the ultimate impact is not directly stated.

All releases of Assimp up to and including 6.0.2 are affected. Any application that links to these versions and processes FBX files is potentially vulnerable.

The absence of CVSS and EPSS metrics means the severity must be inferred from the nature of a heap buffer overflow, which is typically high. The flaw can be triggered when an application imports an attacker‑crafted FBX file; the attack vector is therefore through untrusted file content, and an attacker would need the target to load the malicious file. The vulnerability is not listed in the CISA KEV catalog, but its exploitation risk is significant enough to warrant attention.