CVE-2025-70070: Assimp v6.0.2 DoS Vulnerability

CVE-2025-70070 Overview

CVE-2025-70070 is a null pointer dereference vulnerability [CWE-476] in the Open Asset Import Library (Assimp) version 6.0.2. The flaw resides in the MeshGeometry::MeshGeometry() constructor located in FBXMeshGeometry.cpp. A remote attacker can trigger the issue by supplying a crafted FBX file to an application that uses Assimp for 3D asset import. Successful exploitation causes the consuming process to crash, resulting in a denial of service condition.

Critical Impact

Processing a malicious FBX file with Assimp 6.0.2 leads to a null pointer dereference in the FBX mesh parser, terminating the host application and disrupting any pipeline that relies on Assimp for asset ingestion.

Affected Products

• Assimp (Open Asset Import Library) version 6.0.2
• Applications and game engines that bundle or link against Assimp 6.0.2 for FBX parsing
• Asset processing pipelines exposing Assimp to untrusted FBX input

Discovery Timeline

• 2026-05-04 - CVE-2025-70070 published to NVD
• 2026-05-05 - Last updated in NVD database

Technical Details for CVE-2025-70070

Vulnerability Analysis

The vulnerability is classified as a null pointer dereference [CWE-476] in Assimp's FBX importer. When MeshGeometry::MeshGeometry() constructs a mesh object from an FBX scene graph, it dereferences a pointer derived from FBX node data without validating that the pointer is non-null. A specially crafted FBX file can produce the missing or malformed substructure that the constructor expects to be present.

The attack requires user interaction, since the victim must open or import the malicious asset. There is no impact on confidentiality or integrity, but availability of the host process is fully compromised. The vulnerability is reachable across the network because FBX files are commonly transferred and processed automatically by build pipelines, content delivery systems, and 3D viewers.

Root Cause

The root cause is missing validation of pointer state inside FBXMeshGeometry.cpp before the MeshGeometry constructor accesses geometry-related fields. The parser assumes that referenced nodes and arrays are present after FBX parsing completes. When the input file omits or corrupts these fields, the resulting pointer is null, and the subsequent dereference triggers an unrecoverable segmentation fault.

Attack Vector

An attacker delivers a crafted FBX file to a target that processes it with Assimp 6.0.2. Distribution channels include game asset marketplaces, modding portals, email attachments, web uploads to 3D viewers, and CI pipelines that parse user-submitted models. The victim must load the file, after which the application terminates. Repeated submissions can be used to deny service to automated asset processors.

A proof-of-concept FBX sample is published in a public GitHub Gist exploit reference. Refer to the Assimp project site for upstream source and issue tracking.

Detection Methods for CVE-2025-70070

Indicators of Compromise

• Process crashes or segmentation faults in applications linked against libassimp immediately after loading an FBX file
• Core dumps showing the faulting frame inside Assimp::FBX::MeshGeometry::MeshGeometry or FBXMeshGeometry.cpp
• Repeated failed asset imports originating from the same uploader or source IP in build and content pipelines

Detection Strategies

• Inventory software that statically links or ships Assimp 6.0.2, including game engines, DCC tools, and asset converters
• Inspect FBX files in transit for malformed or truncated geometry sections prior to handing them to Assimp
• Hunt for unexpected termination of asset-processing services correlated with FBX file ingestion events

Monitoring Recommendations

• Alert on abnormal exit codes or crash telemetry from processes that invoke Assimp parsing routines
• Log all FBX uploads with file hash, source identity, and downstream parser outcome to support forensic review
• Track EPSS movement for CVE-2025-70070 to detect changes in observed exploitation likelihood

How to Mitigate CVE-2025-70070

Immediate Actions Required

• Identify all internal and third-party software that bundles Assimp 6.0.2 and restrict its exposure to untrusted FBX content
• Sandbox asset import workflows so that a parser crash cannot affect the broader application or pipeline
• Reject FBX uploads from untrusted sources at the perimeter until a fixed Assimp version is deployed

Patch Information

No vendor patch reference is included in the published CVE record at the time of writing. Monitor the Assimp project site and the upstream repository for an updated release that addresses the null pointer dereference in FBXMeshGeometry.cpp. Upgrade to the fixed version as soon as it becomes available and rebuild any downstream applications that statically link Assimp.

Workarounds

• Disable the FBX importer in Assimp builds where FBX support is not required
• Run Assimp parsing in an isolated process with automatic restart and resource limits to contain denial of service impact
• Pre-validate FBX files using a separate, hardened parser or schema check before passing them to Assimp

# Configuration example: isolate Assimp parsing in a restricted systemd service
# /etc/systemd/system/asset-importer.service
[Service]
ExecStart=/usr/local/bin/asset-importer
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
MemoryMax=512M
TasksMax=64
Restart=on-failure
RestartSec=2s