CVE-2025-70070: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-70070 is a denial-of-service vulnerability in the Open Asset Import Library (Assimp) version 6.0.2, caused by a NULL pointer dereference in the FBX mesh geometry parser. A remote attacker can exploit this by supplying a crafted FBX file to any application using Assimp, causing the importing process to crash. The vulnerability was discovered by TaeYong LEE (GunP4ng) and published on May 4, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a NULL pointer dereference (CWE-476) combined with a reachable assertion (CWE-617) in code/AssetLib/FBX/FBXMeshGeometry.cpp within the Assimp::FBX::MeshGeometry::MeshGeometry() constructor. During FBX file parsing, the code iterates over Layer elements and directly accesses tokens[0] without first verifying that the token list is non-empty. A crafted FBX file containing a Layer element with an empty token list causes an unchecked dereference at line 171, crashing the process. The fix requires adding a bounds check before accessing tokens[0] and rejecting malformed Layer elements (GunP4ng Gist, GitHub Advisory).

Successful exploitation results in a deterministic crash of any application that uses Assimp to import FBX files, causing a denial of service. There is no impact on confidentiality or data integrity — only availability is affected. Any service or application (e.g., 3D editors, game engines, content pipelines) that processes untrusted FBX files via Assimp 6.0.2 is at risk of service disruption (GunP4ng Gist, GitHub Advisory).

No public proof-of-concept exploit code or active in-the-wild exploitation has been observed as of the time of publication. The vulnerability was identified through fuzzing (AFL/ASAN corpus) by the researcher, and the crash is deterministically reproducible with a minimized FBX input. The EPSS score is approximately 0.105–0.166%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, GunP4ng Gist).

1. Craft a malicious FBX file: Create an FBX file containing a Layer element with an empty token list, which violates the assumption made by Assimp's parser in FBXMeshGeometry.cpp.
2. Deliver the file to the target: Provide the crafted FBX file to a target application that uses Assimp 6.0.2 for 3D asset import — for example, via a file upload endpoint, shared storage, or social engineering (user interaction is required).
3. Trigger import: The target application calls Assimp's import routine on the malicious FBX file, invoking MeshGeometry::MeshGeometry() in FBXMeshGeometry.cpp.
4. Crash occurs: The parser iterates over Layer elements and accesses tokens[0] without checking if the token list is non-empty, triggering a NULL pointer dereference at line 171 and crashing the importing process, resulting in denial of service (GunP4ng Gist).

• File System: Presence of unexpected or externally supplied .fbx files in application upload or asset directories, particularly files with minimal or malformed structure.
• Process: Unexpected crashes or core dumps of applications using Assimp (e.g., 3D editors, game engines, content pipelines); crash stack traces referencing Assimp::FBX::MeshGeometry::MeshGeometry() in FBXMeshGeometry.cpp at line 171.
• Logs: Application error logs showing segmentation faults, ASAN reports, or unhandled exceptions originating from the Assimp FBX importer; repeated crash events triggered by the same or similar FBX input files (GunP4ng Gist).

Upgrade Assimp to a version beyond 6.0.2 once a patched release is available (the fixed version was listed as TBD at time of disclosure). As interim mitigations: implement input validation and sanitization for FBX files before passing them to Assimp; run Assimp in a sandboxed or isolated process to contain crash impact; and restrict file upload or processing endpoints to trusted sources only. Monitor applications using Assimp for unexpected crashes or service interruptions (GitHub Advisory, Red Hat Bugzilla).

Red Hat tracked the vulnerability via their Bugzilla system (Bug 2465295) with a medium severity rating, and it was also picked up by SUSE CVE tracking. The GitHub Advisory Database published it as "Moderate" severity. No significant public researcher commentary or media coverage beyond the initial disclosure gist and automated CVE aggregators has been observed (Red Hat Bugzilla, GitHub Advisory).