The vulnerability is a NULL pointer dereference that occurs when the Ogre3D binary mesh importer processes an animation track that references a missing submesh or absent shared geometry. When a crafted .mesh file containing such a track is loaded, the library dereferences a null pointer during ReadAnimationKeyFrames, causing the host application to crash. This results in a denial of service but does not provide remote code execution.

Any installation of Open Asset Import Library (Assimp) version 6.0.5 or earlier is affected. This includes projects that link against Assimp for importing Ogre3D mesh files, such as game engines, simulation tools, and any third‑party software that uses Assimp for asset handling. The vulnerability is present in the OgreBinarySerializer component of the library.

The CVSS score of 6.8 indicates a moderate impact if exploited. The EPSS score of less than 1% suggests a low probability of exploitation in the field at this time. The vulnerability is not currently listed in the CISA KEV catalog. Attackers can trigger the crash by supplying a malicious .mesh file that the application imports; this may be done locally or, if the application accepts files from untrusted sources (e.g., over a network or user upload), remotely. Based on the description, it is inferred that the attack requires the ability to influence the file import process so that a crafted mesh is parsed by the Assimp library.