Vulnerability · Published May 4, 2026 · Assigned by mitre
CVE-2025-70067
Critical 9.8
In plain English
A critical-severity heap buffer overflow in the assimp package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.3%top 72.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Buffer Overflow vulnerability exists in Assimp versions up to 6.0.2 in the FBX Importer. The vulnerability occurs in aiMaterial::AddBinaryProperty, where a property key string from a crafted FBX file is copied into a fixed-size heap buffer using strcpy() without runtime length validation
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | assimp | no fix listed | DEBIAN-CVE-2025-70067 |
| Debian:13 | assimp | no fix listed | DEBIAN-CVE-2025-70067 |
| Debian:14 | assimp | no fix listed | DEBIAN-CVE-2025-70067 |
| Ubuntu:22.04:LTS | assimp | no fix listed | UBUNTU-CVE-2025-70067 |
| Ubuntu:24.04:LTS | assimp | no fix listed | UBUNTU-CVE-2025-70067 |
| Ubuntu:25.10 | assimp | no fix listed | UBUNTU-CVE-2025-70067 |
| Ubuntu:26.04:LTS | assimp | no fix listed | UBUNTU-CVE-2025-70067 |
| Ubuntu:26.10 | assimp | no fix listed | UBUNTU-CVE-2025-70067 |
Affected products (as reported)
Weakness: CWE-122 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H