CVE-2025-70067 is a buffer overflow vulnerability in the Assimp library (up to version 6.0.2) affecting the FBX Importer. The vulnerability occurs because aiMaterial::AddBinaryProperty copies a property key string from a crafted FBX file into a fixed-size heap buffer using strcpy() without runtime length validation, leading to potential heap-based buffer overflow. This can result in arbitrary code execution or denial of service. The vulnerability has a CVSS v3.1 base score of 9.8, reflecting its critical impact and ease of exploitation (network vector, no privileges or user interaction required). No patch or official remediation is currently documented.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code, cause application crashes, or disrupt service availability when processing maliciously crafted FBX files. The vulnerability affects confidentiality, integrity, and availability of affected systems using the vulnerable Assimp versions. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted or unauthenticated FBX files with vulnerable versions of Assimp. Monitor official Assimp project communications for updates regarding patches or mitigations.