Assimp’s Half‑Life 1 MDL Loader function HL1MDLLoader::read_sequence_infos performs an out-of-bounds read when the aiString argument is manipulated. The flaw allows a local attacker to read unintended memory content, potentially exposing confidential data stored in the process address space. No remote execution vector is described, so the impact is confined to confidentiality loss for users with local write access to the library’s input streams.

The vulnerability exists in the Assimp library up through version 6.0.4. Any system or application that links against this version and uses the Half‑Life 1 MDL loader may be affected. The exact scope depends on how the library is employed, but any local user capable of supplying crafted MDL files could trigger the error.

The CVSS score of 4.8 indicates a moderate severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. The attack requires local possession of the process that loads MDL files, so the opportunity for exploitation is limited to users or services running the library. While there is no remote or privilege‑escalation vector, the ability to read arbitrary memory can still aid further attacks, especially if the application handles sensitive content.