The vulnerability is a denial of service in Assimp 6.0.2. A crafted FBX file that exploits a flaw in the FBXMeshGeometry.cpp constructor can cause the library to allocate excessive resources or crash. This flaw corresponds to a NULL pointer dereference scenario (CWE-476). Applications relying on this version can lose availability, leading to degraded user experience or business disruption.

The flaw affects the Assimp library version 6.0.2, which is bundled in many 3D applications, game engines, and content pipelines. Any software that loads FBX files via this version is potentially vulnerable. Vendor details are not disclosed, but any product that ships with Assimp 6.0.2 is at risk.

The CVSS score is 6.5 and no EPSS value is available, so the exploit likelihood cannot be quantified. The issue is not in the CISA KEV catalog. An attacker can provide a malicious FBX file to the vulnerable application, triggering the constructor and forcing the process to crash or consume excessive memory. The attack can be performed remotely over the network by exploiting any exposed interface that accepts FBX files.