This vulnerability exists in the Assimp library, affecting versions 6.0.0 through 6.0.4. It is located in the function Assimp::MDL::HalfLife::HL1MDLLoader::read_animations within the HL1MDLLoader.cpp file. The issue leads to a heap-based buffer overflow when processing animation data. Exploitation requires local access and low privileges, with no user interaction needed. The vulnerability was publicly disclosed with an exploit available, but the project has only tagged it as a bug without providing an official fix or patch. The CVSS 4.0 vector indicates low attack complexity and privileges required, but the impact on confidentiality, integrity, and availability is limited.

Successful exploitation of this vulnerability can cause a heap-based buffer overflow, potentially leading to application crashes or memory corruption. Since the attack requires local access and low privileges, the impact is limited to users who can execute code on the affected system. There is no indication of remote exploitation or elevated privileges. The medium severity reflects moderate risk due to local attack vector and limited impact scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch has been announced, users should monitor the Assimp project for updates. Until a patch is available, restrict local access to trusted users only and consider applying any available workarounds or mitigations recommended by the vendor once published.