The flaw is a heap-based buffer overflow that occurs in the InternReadFile function of CSMLoader.cpp when processing CSM files. Overflow corrupts heap memory belonging to the process that runs the import, which can lead to crashes or, if successfully exploited, corrupt program data locally. The weakness is reflected as CWE-119 and CWE-122.

The issue appears in the Open Asset Import Library, named Assimp, in all releases up to 6.0.5. Any application that links against Assimp and uses its CSM file handler is potentially vulnerable. The vulnerable code resides in the CSM File Handler component that parses CSM files.

The CVSS score is 4.8, indicating medium severity, while the EPSS score of less than 1 % shows a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Although the attack requires local execution—most likely a crafted CSM file—the published exploit demonstrates that local malicious actors can trigger the overflow.