A flaw exists in the HL1MDLoader component of the Assimp library, where manipulating the ‘num.total’ argument triggers a heap-based buffer overflow in HL1MDLoader::extract_anim_value. The overflow can corrupt adjacent memory structures and, if exploited, may allow an attacker to execute arbitrary code or cause a denial of service. The vulnerability only allows local exploitation, meaning the adversary must have the ability to run code on the target system. It can compromise confidentiality, integrity, and availability of the affected process.

Assimp library users employing versions up to and including 6.0.4 are affected. The vulnerability is confined to the Half‑Life 1 MDL Loader component and does not extend to other Assimp build targets.

The CVSS score of 4.8 reflects a moderate risk severity. EPSS is not available, so the likelihood of exploitation is uncertain; however, a public exploit has been released and the bug has been reported as a confirmed issue. The vulnerability is not listed in the CISA KEV catalog, indicating no known large‑scale exploitation yet. Attackers would need local access to the system to trigger the overflow, and the exploit does not appear to target network‑exposed inputs.