CVE-2025-70069: Assimp DoS Vulnerability

CVE-2025-70069 Overview

CVE-2025-70069 is a denial of service vulnerability in Open Asset Import Library (Assimp) version 6.0.2. The flaw resides in the ConvertMeshMultiMaterial() method within FBXConverter.cpp. A remote attacker can trigger uncontrolled resource consumption [CWE-400] by supplying a crafted FBX file to applications that link Assimp for 3D asset parsing. Successful exploitation causes the host process to exhaust available resources, disrupting availability without requiring authentication or user interaction. Assimp is widely embedded in game engines, 3D modeling tools, and content pipelines, expanding the downstream impact of this defect.

Critical Impact

Remote attackers can crash or hang any application using Assimp 6.0.2 by delivering a malicious FBX file, with no authentication required.

Affected Products

• Open Asset Import Library (Assimp) version 6.0.2
• Applications and engines that statically or dynamically link Assimp 6.0.2 for FBX import
• Downstream 3D content pipelines processing untrusted FBX assets

Discovery Timeline

• 2026-05-04 - CVE-2025-70069 published to NVD
• 2026-05-05 - Last updated in NVD database

Technical Details for CVE-2025-70069

Vulnerability Analysis

The vulnerability is a denial of service condition triggered during FBX scene conversion. Assimp's FBXConverter.cpp implements ConvertMeshMultiMaterial() to translate multi-material FBX meshes into Assimp's internal scene graph. When the converter processes a maliciously crafted FBX file, control flow within this method leads to uncontrolled resource consumption. The process consumes excessive memory or CPU until it becomes unresponsive or terminates. The Common Weakness Enumeration classification [CWE-400] confirms uncontrolled resource consumption as the root weakness class.

Assimp parses untrusted binary and text-based 3D formats, so any application that imports user-supplied FBX content inherits this exposure. Game engines, asset previewers, render farms, and online model converters are all candidates for exploitation.

Root Cause

The defect originates from missing or insufficient bounds and structural validation inside ConvertMeshMultiMaterial(). The function does not adequately constrain values derived from FBX header fields before driving allocation or iteration. Attacker-controlled fields can therefore steer the converter into runaway loops or oversized allocations.

Attack Vector

Exploitation occurs over the network attack vector when an Assimp-backed service ingests attacker-supplied FBX files. Attack complexity is low and no privileges or user interaction are needed beyond delivering the file to the parser. A public proof-of-concept demonstrating the crash is available in the GitHub Gist Exploit Code. The vulnerability mechanism is described in prose only; refer to the Assimp Project Homepage for source-level technical details on the converter routine.

Detection Methods for CVE-2025-70069

Indicators of Compromise

• Crashes, hangs, or out-of-memory terminations of processes that link libassimp while parsing FBX files
• FBX files originating from untrusted sources whose parsing triggers sustained 100% CPU or rapid memory growth
• Repeated upload attempts of malformed FBX assets to web-based 3D converters or asset pipelines

Detection Strategies

• Inventory applications and services that bundle Assimp 6.0.2 using software composition analysis against build manifests and shipped binaries
• Inspect crash telemetry for stack frames containing ConvertMeshMultiMaterial or FBXConverter symbols
• Apply file-format heuristics at upload boundaries to flag FBX files with anomalous mesh or material counts before they reach the parser

Monitoring Recommendations

• Alert on parser processes exceeding memory or CPU thresholds when handling user-submitted 3D content
• Forward process crash and resource-exhaustion events to the SIEM for correlation against FBX ingestion sources
• Track ingress of FBX files from external networks and tag the originating identities for review

How to Mitigate CVE-2025-70069

Immediate Actions Required

• Identify all systems running Assimp 6.0.2 and disable FBX ingestion paths until a patched build is deployed
• Isolate asset-processing services that accept untrusted uploads behind sandboxed workers with strict memory and CPU limits
• Reject FBX files from untrusted sources at the application boundary while a fix is pending

Patch Information

No vendor patch advisory is referenced in the published NVD entry at the time of writing. Monitor the Assimp Project Homepage and the upstream repository for an updated release that supersedes 6.0.2 and addresses ConvertMeshMultiMaterial(). Rebuild and redistribute any downstream applications once a fixed version is available.

Workarounds

• Run Assimp-based parsers in isolated processes with cgroup or job-object resource caps to contain denial of service impact
• Enforce maximum file size and structural validation on FBX uploads before invoking Assimp
• Disable the FBX importer in Assimp builds where 3D pipelines do not require FBX support

# Configuration example: constrain Assimp parser workers with systemd resource limits
[Service]
ExecStart=/usr/local/bin/asset-importer
MemoryMax=512M
CPUQuota=50%
TasksMax=64
PrivateTmp=true
NoNewPrivileges=true