This vulnerability exists in the Assimp library version identified by commit 17c12da, specifically in the Node Parser component's MDLLoader.cpp file. The function AddBonesToNodeGraph_3DGS_MDL7 improperly manipulates the bones_num argument, resulting in a heap-based buffer overflow. This memory corruption flaw can be triggered remotely. Public exploit code has been released, increasing the risk of exploitation. No official patch or remediation has been published by the vendor at this time.

Successful exploitation of this vulnerability could lead to heap memory corruption, potentially allowing an attacker to execute arbitrary code or cause a denial of service remotely. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, and partial impacts on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider applying workarounds such as disabling or restricting use of the vulnerable function or component if possible, and monitor for updates from the project. Avoid processing untrusted MDL files until a fix is available.