CVE-2025-70067: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-70067 is a heap-based buffer overflow vulnerability in the Assimp Open Asset Import Library's FBX Importer, affecting versions up to and including 6.0.2. The flaw resides in aiMaterial::AddBinaryProperty (code/Material/MaterialSystem.cpp), where a property key string from a crafted FBX file is copied into a fixed-size heap buffer using strcpy() without runtime length validation. It was published on May 4, 2026, and carries a CVSS v3.1 base score of 9.8 (Critical) (Github Advisory, bugzilla.redhat.com). The vulnerability was discovered and reported by TaeYong LEE (GunP4ng) (Researcher Gist).

The root cause is classified as CWE-122 (Heap-based Buffer Overflow) and CWE-120 (Buffer Copy without Checking Size of Input). In aiMaterial::AddBinaryProperty, the code records the key length and performs a bounds check via ai_assert(AI_MAXLEN > pcNew->mKey.length), but then copies the attacker-controlled string with strcpy(pcNew->mKey.data, pKey). Critically, ai_assert is compiled out in Release and RelWithDebInfo builds where NDEBUG is defined, leaving the unbounded strcpy() without any runtime enforcement. An attacker can exploit this by supplying a crafted FBX file containing a material property name exceeding the fixed AI_MAXLEN capacity, triggering a write beyond the heap-allocated aiString buffer when the file is imported (Researcher Gist, Github Advisory). The vulnerability is only reproducible in non-debug (release-style) builds; debug builds retain the assertion check (Researcher Gist).

Successful exploitation can result in heap memory corruption, application crash (denial of service), and potentially arbitrary code execution depending on allocator behavior, application context, and runtime hardening in place. Because Assimp is widely used as a dependency in 3D applications, game engines, and content pipelines, the blast radius extends to any application that processes untrusted FBX files using the affected library. The vulnerability requires no privileges and no user interaction, meaning a remote attacker can deliver a malicious FBX file through any network-accessible file upload or processing endpoint to trigger the overflow (Github Advisory, Researcher Gist).

As of the time of reporting, there is no public proof-of-concept exploit code and no confirmed in-the-wild exploitation (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (0.000170), placing it in a low exploitation probability tier in the near term (Github Advisory). No threat actor attribution has been reported. The vulnerability was confirmed using AddressSanitizer in release-equivalent builds by the original researcher (Researcher Gist).

1. Craft a malicious FBX file: Create an FBX file containing a material property with a key string whose length exceeds the fixed AI_MAXLEN buffer size used by Assimp's aiString type.
2. Identify a target application: Locate an application or service that uses Assimp ≤ 6.0.2 (compiled in Release/RelWithDebInfo mode with NDEBUG defined) to import FBX files — such as a 3D model viewer, game asset pipeline, or web-based 3D content processor.
3. Deliver the malicious file: Submit the crafted FBX file to the target application via any available file upload mechanism, shared storage, or network-accessible import endpoint.
4. Trigger FBX material parsing: The application processes the FBX file, reaching the FBX material parsing path that calls aiMaterial::AddBinaryProperty in code/Material/MaterialSystem.cpp.
5. Overflow the heap buffer: The strcpy() call copies the oversized property key into the fixed-size aiString buffer without bounds checking (assertion compiled out in release builds), overflowing the heap-allocated material property object.
6. Achieve impact: Depending on heap layout and runtime hardening, the overflow results in a crash (DoS) or, in favorable conditions, memory corruption that may be leveraged for code execution (Researcher Gist, Github Advisory).

• File System: Presence of unexpected or externally sourced .fbx files in application import directories, especially those with unusually large material property name fields.
• Process: Application crash dumps or core files generated by the process hosting Assimp during FBX import; AddressSanitizer reports of heap-buffer-overflow in aiMaterial::AddBinaryProperty or MaterialSystem.cpp.
• Logs: Application error logs showing crashes or unhandled exceptions during FBX file loading; stack traces referencing aiMaterial::AddBinaryProperty, strcpy, or Assimp FBX importer code paths.
• Network: Unexpected or anomalous FBX file uploads to services that process 3D assets, particularly files with oversized material property names (Researcher Gist).

Upgrade Assimp to a version beyond 6.0.2; the upstream fix commit is referenced as 531f73597eb357e29b241c1803d7f7893e59d225 (Researcher Gist). The Assimp project has released version 6.0.5 as a bugfix release (Assimp GitHub). As a workaround, restrict FBX file processing to trusted sources only, or disable the FBX importer if it is not required. Organizations using Assimp as a dependency should audit their dependency trees and apply updates from downstream distributors such as Red Hat, SUSE, and Amazon Linux, which have issued advisories (bugzilla.redhat.com).

Red Hat tracked the vulnerability via Bugzilla (Bug 2465308) and assigned it medium severity in their internal triage, noting it allows arbitrary code execution via a crafted file (bugzilla.redhat.com). SUSE and openSUSE issued security announcements covering this CVE alongside other Assimp vulnerabilities. Amazon Linux also issued an advisory (ALAS2-2026-3335). The vulnerability was detected by Tenable Nessus (plugin 312093 and 319789), indicating broad scanner coverage. No significant social media discussion or notable researcher commentary beyond the original disclosure gist has been observed.