This vulnerability exists in the Assimp library version identified by commit 17c12da, specifically in the Node Parser component's MDLLoader.cpp file. The function AddBonesToNodeGraph_3DGS_MDL7 improperly manipulates the bones_num argument, causing a heap-based buffer overflow. This memory corruption can be triggered remotely, potentially allowing an attacker to execute arbitrary code or cause a denial of service. Although the issue was reported early, the vendor has not provided a fix or official remediation guidance. Exploit code is publicly available, increasing the risk of exploitation.

Successful exploitation of this heap-based buffer overflow can lead to memory corruption, which may allow remote attackers to execute arbitrary code or crash the application using the vulnerable Assimp library. The CVSS 4.0 score of 5.3 reflects a medium severity with network attack vector, low complexity, no privileges required, and user interaction needed. Confidentiality, integrity, and availability impacts are all rated low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor the project for updates. Until a patch is available, avoid processing untrusted MDL files or use alternative libraries if possible.