Assimp versions up to 6.0.4 contain a flaw in HL1MDLLoader::extract_anim_value where manipulation of the ‘num.total’ argument triggers a heap-based buffer overflow. The vulnerability can corrupt memory adjacent to the overflow target and, if the attacker controls the overflow payload, may result in arbitrary memory corruption. The description does not explicitly confirm code execution or denial of service but indicates that the exploit may be used for attacks and a public exploit has been released. It is an internal buffer overflow (CWE‑119, CWE‑122, CWE‑131).

Assimp library users that employ any release up to and including 6.0.4 are affected. The issue is confined to the Half‑Life 1 MDL Loader component and does not impact other Assimp loaders.

The CVSS base score of 4.8 places the vulnerability in the moderate severity range while the EPSS score is reported as <1%, implying a very low likelihood of real‑world exploitation at present. The vulnerability is not listed in the CISA KEV catalog, and exploitation requires local access (the attacker must be able to run code on the target machine). The public exploit demonstrates that an attacker can trigger the overflow, but it does not target externally reachable inputs. The lack of network‑exposed attack surface reduces the potential impact scope to systems that load untrusted MDL files locally.