CVE-2025-70067 -- CVSS 9.8 Vulnerability Briefing

CVE-2025-70067 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2025-70067 is a critical buffer overflow vulnerability in the FBX Importer component of Assimp (Open Asset Import Library), affecting versions up to and including 6.0.2.

Technical Detail

The flaw resides in the aiMaterial::AddBinaryProperty function within Assimp's FBX parsing code, where a property key string sourced from a crafted FBX file is processed without adequate bounds checking, resulting in a heap or stack buffer overflow condition. An attacker can trigger this vulnerability by supplying a maliciously constructed FBX file to any application that uses the affected Assimp library to load 3D assets. Successful exploitation could lead to arbitrary code execution in the context of the application processing the file, with potential for full process compromise depending on the deployment environment.

Exploitation Status

No known exploit exists for this vulnerability at this time. It is not listed in the CISA Known Exploited Vulnerabilities catalog. There is no confirmed public proof-of-concept code as of the date of this briefing. Despite the absence of known exploitation, the critical CVSS score of 9.8 reflects the low complexity and high impact potential of the flaw, warranting prompt remediation.

Who Is Targeting This

No specific threat actor attribution at this time. No campaigns or targeted sectors have been associated with this vulnerability. Given that Assimp is widely used in game engines, 3D modeling tools, and industrial visualization software, the attack surface is broad and could attract opportunistic actors targeting creative or engineering workflows.

What To Do

Organizations using Assimp should upgrade to a patched version beyond 6.0.2 as soon as one is available from the upstream project, and should monitor the official Assimp GitHub repository for patch releases. In the interim, applications should be configured to reject or sandbox untrusted FBX file input, and file processing pipelines should not be exposed to user-supplied 3D assets without validation controls. Detection efforts should focus on anomalous process behavior or crashes in applications that invoke Assimp's FBX import functionality, which may indicate exploitation attempts. Software bills of materials should be reviewed to identify all internal products and services that bundle the affected library.