CVE-2025-70067 describes a buffer overflow vulnerability in the Assimp library's FBX Importer, specifically in the aiMaterial::AddBinaryProperty function. The vulnerability is due to the use of strcpy() to copy a property key string from a crafted FBX file into a fixed-size heap buffer without runtime length checks, potentially causing heap corruption. The affected versions include Assimp up to 6.0.2. No patch or official remediation details have been published, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability could result in heap memory corruption, which may lead to application crashes or potentially arbitrary code execution depending on the context in which Assimp is used. However, no confirmed exploit or impact details beyond the buffer overflow are available.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid processing untrusted or malformed FBX files with vulnerable versions of Assimp. Monitoring vendor channels for updates is recommended.