A heap-based buffer overflow occurs in Assimp’s Half‑Life 1 MDL Loader within the HL1MDLLoader::read_meshes function. The overflow can be triggered by a specially crafted MDL file, potentially allowing an attacker with local execution permissions to corrupt heap memory and execute arbitrary code or crash the application. This corresponds to CWE-119, CWE-120, and CWE-122 weaknesses involving improper bounds checking and memory corruption.

The vulnerability affects the Assimp library up to and including version 6.0.4. The problem exists in the HL1MDLLoader.cpp component that handles HL1 MDL files. Users who employ the Assimp library to load Half‑Life 1 model data in any application may be exposed to the risk, provided they process untrusted MDL files.

With a CVSS score of 4.8 the severity is moderate. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is local, requiring the attacker to supply a malicious MDL file that the application will load. A public exploit has already been disclosed, indicating that malicious payloads can be crafted and that vulnerable installations can be compromised if the application loads untrusted model data.