The flaw resides in the GenerateOutputMeshes_3DGS_MDL7 function within Assimp’s MDLLoader.cpp, where malformed MDL7 model data causes a buffer overflow. A malformed model file can thus corrupt memory and potentially provide an attacker with remote code execution capabilities. The report specifies that remote exploitation is possible and that the issue has been publicly disclosed.

The vulnerability affects the Open Asset Import Library (Assimp) component, specifically the MDL importer for 3DGS MDL7. The impacted code base is identified by the commit 17c12da. No explicit version ranges are listed, but any instance of the Assimp library that contains this MDLLoader.cpp file without the appropriate patch is potentially affected.

The CVSS score is 5.3, indicating moderate severity, with no EPSS score available and the vulnerability not present in CISA’s KEV catalog. The remote attack vector is confirmed, meaning the attack can be performed over a network by supplying a crafted MDL7 file. Because the vector is remote and the exploit has been publicly released, the risk is elevated for systems that process untrusted MDL7 files without additional safeguards.