A buffer overflow occurs in the Assimp library’s FBX Importer within aiMaterial::AddBinaryProperty, where a property key string from a crafted FBX file is copied into a fixed‑size heap buffer using strcpy() without runtime length validation. This unchecked copy can corrupt heap memory; the CVE description does not state the exact consequence, but it is inferred that such an overflow could enable arbitrary code execution or other memory corruption, potentially compromising confidentiality, integrity, or availability. The weakness relates to CWE-120 (Buffer Copy without Checking Size) and CWE-122 (Buffer Over-read/Overflow).

Assimp versions up to and including 6.0.2 are affected. Any application that links against these releases and processes FBX files is potentially vulnerable. The original vendor information is not listed, so the affected products are identified only as the Assimp library itself.

The CVSS score of 9.8 indicates the highest severity. The EPSS score of < 1% indicates a very low but nonzero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. It can be triggered by feeding an attacker‑crafted FBX file to the importer, implying an untrusted file payload as the attack vector. Because the CVE description does not provide a confirmed exploit, the risk is primarily theoretical but still significant.