CVE-2025-70071 Details

A denial-of-service vulnerability has been identified in Assimp version 6.0.2. The issue arises in the FBX parser, specifically within the 'ParseVectorDataArray' function for 'aiVector2D' data. The vulnerability allows remote attackers to cause excessive memory allocation or process termination by exploiting untrusted binary array metadata from crafted FBX files. This exploitation leads to process crashes or aborts during parsing, causing a denial-of-service condition.

It is recommended to bound binary array counts before allocation, validate array counts against the remaining input size and expected element width, and reject impossible or excessive vector data arrays early. Adding regression tests for large binary vector array counts can also help prevent this issue.