A heap‑based buffer overflow exists in the decompressBlock function of the Assimp file parser. The overflow is triggered by malicious input to the compression routine and can corrupt memory on the heap. An attacker can supply crafted data and, because the function is exposed over the network in applications that use Assimp, the vulnerability can be triggered remotely. The flaw may allow an attacker to cause a crash or to execute arbitrary code, depending on the surrounding program context and the data supplied.

The issue impacts the Open Asset Import Library (Assimp) component, specifically from commit 17c12da onward. All applications that link against this version of Assimp and that process compressed files are potentially affected. No specific vendor versions or distribution packages are listed in the CNA data, so the vulnerability applies to any build that includes the unmodified decompressBlock implementation.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score of 0.00264 indicates a very low but non‑zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Public exploit code has been released, so the attack is feasible. The likely attack vector is remote delivery of a maliciously crafted file to an application that uses Assimp, leading to memory corruption and potential arbitrary code execution. Risk remains moderate but increases sharply if the target application processes untrusted input without additional safeguards.