Technical impact
Assimp versions through 6.0.6 contain an integer overflow in OgreBinarySerializer::ReadSubMesh. The overflow occurs when a crafted Ogre binary .mesh file specifies an excessively large index count, causing the 32‑bit buffer size to wrap. This triggers a segmentation fault in the aiMesh destructor during scene teardown, resulting in a crash and potential denial of service for applications that process the file.
Affected Systems
Affected systems are installations of the Assimp library, version 6.0.6 and earlier. This includes any software that statically or dynamically links with Assimp for mesh parsing, such as game engines, 3D rendering applications, and development tools that rely on the library.
Risk and Exploitability
The CVSS base score of 6.8 indicates moderate severity. Exploitation is limited to supplying malicious .mesh files; the vulnerability is not remotely exploitable by code execution, but it can cause a crash. No EPSS or KEV data is available, so the likelihood of widespread exploitation is uncertain. Defensive measures should focus on preventing the library from processing untrusted files and on ensuring users apply any available patches.
