This vulnerability in Assimp affects the HL1MDLLoader.cpp file's read_meshes function, causing a heap-based buffer overflow when processing Half-Life 1 MDL files. The flaw is exploitable only by local attackers with limited privileges and does not require user interaction. The vulnerability is present in versions 6.0.0 through 6.0.4. Although the issue is publicly disclosed and tagged as a bug by the project, no official fix or patch has been confirmed. The CVSS 4.0 vector indicates low attack complexity and limited impact on confidentiality, integrity, and availability.

The heap-based buffer overflow could allow a local attacker to cause memory corruption, potentially leading to application crashes or limited code execution under the context of the vulnerable process. The impact is limited by the requirement for local access and low privileges. There is no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users and avoid processing untrusted Half-Life 1 MDL files with vulnerable Assimp versions. Monitor for vendor updates addressing this issue.