A heap-based buffer overflow exists in the HL1MDLLoader::read_animations function of the Assimp Half‑Life 1 MDL Loader. When a crafted .mdl file is parsed, the animation data overflows a heap buffer, which can corrupt memory or lead to arbitrary code execution if the local attacker can supply the file to the parsing process. The vulnerability is limited to local exploitation and does not provide remote code execution by itself.

Assimp library versions up to and including 6.0.4, which contain the vulnerable HL1MDLLoader component. Any system that loads Half‑Life 1 MDL files with these versions is impacted.

The CVSS score of 4.8 indicates moderate severity. The EPSS score is 0.00013, which is less than 1 % and suggests a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Publicly available exploit code demonstrates the vulnerability can be leveraged locally, and an attacker with local access can potentially achieve arbitrary code execution by serving a malicious .mdl file to a vulnerable application.