CVE-2025-70071: Assimp v6.0.2 DoS Vulnerability

CVE-2025-70071 Overview

CVE-2025-70071 is a denial of service vulnerability in the Open Asset Import Library (Assimp) version 6.0.2. The flaw resides in the ParseVectorDataArray() function within FBXParser.cpp. A remote attacker can trigger uncontrolled resource consumption by supplying a crafted FBX file to an application that processes 3D assets through Assimp. The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption). Applications that parse untrusted FBX content, including 3D modeling tools, game engines, and asset pipelines, may crash or become unresponsive when processing malicious input.

Critical Impact
Remote attackers can cause application crashes or service unavailability by submitting malformed FBX files to any software that embeds Assimp 6.0.2 for 3D model parsing.

Affected Products

Open Asset Import Library (Assimp) version 6.0.2
Applications and engines that bundle or link against Assimp 6.0.2 for FBX file parsing
Asset import pipelines that accept untrusted FBX content

Discovery Timeline

2026-05-04 - CVE-2025-70071 published to NVD
2026-05-05 - Last updated in NVD database

Technical Details for CVE-2025-70071

Vulnerability Analysis

The vulnerability exists in the FBX parser component of Assimp, specifically in the ParseVectorDataArray() function defined in FBXParser.cpp. This function deserializes vector data arrays embedded in FBX files into native C++ data structures during model import. When the parser encounters specially crafted size or count fields, it fails to properly bound the memory allocation or iteration logic. This leads to excessive resource consumption that exhausts available memory or CPU cycles. The condition halts the host process or makes it unresponsive. Because Assimp is widely embedded in 3D content pipelines, the impact propagates to any downstream application that loads attacker-supplied FBX files.

Root Cause

The root cause is improper validation of length or count metadata read from the FBX input stream before resource allocation. The ParseVectorDataArray() routine trusts attacker-controlled values when sizing internal buffers or driving parse loops. This pattern matches [CWE-400] Uncontrolled Resource Consumption. The parser does not enforce upper bounds proportional to the actual file size, allowing small malicious files to request large allocations or long-running operations.

Attack Vector

The attack vector is network-reachable through any application that ingests FBX files from untrusted sources. Common scenarios include uploading a model to a web-based 3D viewer, importing assets in a game engine plugin, or processing files through a server-side asset conversion service. The attacker delivers a single crafted FBX file. No authentication or user interaction beyond the import action is required. Successful exploitation results in availability loss for the targeted process. Confidentiality and integrity are not impacted.

No verified exploit code is available beyond a public proof-of-concept gist referenced by the advisory. See the GitHub Gist PoC Code for technical details on the malformed input that triggers the condition.

Detection Methods for CVE-2025-70071

Indicators of Compromise

Repeated process crashes or out-of-memory terminations in services that import FBX files
Sustained high CPU or memory consumption tied to Assimp parser threads during model load
FBX files of unusually small size that cause disproportionate processing time or allocation

Detection Strategies

Inventory applications that link against libassimp or bundle Assimp 6.0.2, including game engines, CAD tools, and conversion utilities
Monitor crash telemetry and core dumps for stack frames referencing ParseVectorDataArray or FBXParser.cpp
Inspect web upload endpoints and asset pipelines for FBX submissions that correlate with worker process restarts

Monitoring Recommendations

Enable resource limits (cgroups, ulimits, or container quotas) on processes that parse user-supplied 3D files and alert on limit breaches
Log file hashes, sizes, and source IP addresses for all FBX uploads to support post-incident triage
Track Assimp library versions across the software bill of materials and flag deployments still on 6.0.2

How to Mitigate CVE-2025-70071

Immediate Actions Required

Identify all applications and services that embed Assimp 6.0.2 and prioritize those exposed to untrusted FBX input
Restrict FBX import functionality to authenticated, trusted users until a fixed library version is deployed
Apply strict file size limits and processing timeouts to FBX import workflows to contain resource exhaustion

Patch Information

No official patched version is referenced in the current NVD entry. Monitor the Assimp Official Site and the upstream Assimp GitHub repository for a release that supersedes 6.0.2 and addresses the ParseVectorDataArray() flaw. Rebuild and redeploy any dependent applications once a fixed version is published.

Workarounds

Disable FBX import in applications where the format is not required, or restrict imports to a sandboxed worker with hard memory and CPU limits
Pre-validate FBX files using an out-of-process scanner with enforced timeouts before passing them to the main application
Run asset conversion services in ephemeral containers that automatically restart on crash to preserve service availability

bash

# Example: enforce resource limits on an Assimp-based importer process
systemd-run --scope \
  -p MemoryMax=512M \
  -p CPUQuota=50% \
  -p TimeoutStopSec=30s \
  /usr/local/bin/asset-importer --input untrusted.fbx