The flaw lies in the MD5Importer::MakeDataUnique function within Assimp’s MD5Loader.cpp. Improper handling of the iNewIndex argument allows a local attacker to overflow a heap buffer, potentially corrupting memory and causing a crash or enabling arbitrary code execution when malicious MD5 files are processed. This is a classic heap‑based buffer overflow (CWE‑119, CWE‑122).

Open Asset Import Library (Assimp) versions up to and including 6.0.2 are vulnerable, affecting the MD5 loader component. No vendor‑specific variants are mentioned; the issue applies to the open‑source Assimp project.

The CVSS score of 4.8 reflects moderate severity, and the attack can only be performed from a local environment. EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog, indicating low likelihood of publicly exploited attacks. Because the flaw is a local heap overflow, a determined attacker with local access could induce crashes or memory corruption by supplying crafted MD5 files.