Assimp versions up to and including 6.0.5 contain an integer overflow in the MD2Importer::ValidateHeader() routine. The flaw allows an attacker to craft an .md2 file with header fields that wrap the 32‑bit size check, bypassing the frame table bounds verification. This results in a heap out‑of‑bounds read that can crash an application or leak the contents of adjacent heap memory, potentially exposing sensitive information.

The vulnerability affects the Assimp library, any application that links against Assimp through version 6.0.5 or earlier. The affected product is Assimp, with the most recent version impacted being 6.0.5. Upgrading to later library releases that incorporate the fix removes the integer overflow in MD2Importer.

The CVSS score of 6.9 indicates a moderate severity, and there is no available EPSS score, so the likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be file‑based, requiring an attacker to supply a malicious .md2 file that an application processes using the MD2 importer. If successful, the crash or data exposure may lead to partial denial of service or confidentiality compromise.