CVE-2025-70067 describes a buffer overflow vulnerability in Assimp's FBX Importer affecting versions up to 6.0.2. The vulnerability occurs in the aiMaterial::AddBinaryProperty function, which copies a property key string from a maliciously crafted FBX file into a fixed-size heap buffer using strcpy() without runtime length checks. This lack of validation can lead to memory corruption, potentially allowing an attacker to execute arbitrary code or cause a denial of service. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No official patch or remediation information is currently provided.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary code, crash the application, or cause denial of service due to heap-based buffer overflow. The vulnerability affects confidentiality, integrity, and availability of the affected system or application using Assimp FBX Importer.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted or unauthenticated FBX files with vulnerable versions of Assimp. Monitor vendor channels for updates regarding patches or mitigations.