CVE-2025-6120: Heap-Based Buffer Overflow in Assimp HL1MDLLoader read_meshes

The Open Asset Import Library (Assimp) is an open-source library designed to import and manipulate various 3D model formats. It is utilized in rendering engines, game development tools, asset pipelines, and visualization software. To parse these legacy formats, Assimp employs specific loader components designed for individual file extensions. One such module is the Half-Life 1 MDL loader, which parses historical game assets.

Legacy 3D format loaders present a significant attack surface because they often parse highly nested, binary, and complex structures. Because Assimp is implemented in C++, memory management is handled manually, requiring robust boundary checks on all parsed offsets and index parameters. A failure to validate these values can lead to severe memory corruption when processing corrupted or maliciously modified input files.

CVE-2025-6120 identifies a critical heap-based buffer overflow inside the HL1 MDL loader component. The vulnerability resides specifically within the read_meshes function located in the source file HL1MDLLoader.cpp. This weakness permits local attackers to supply malformed 3D assets that corrupt heap memory, causing the application to terminate unexpectedly or potentially execute arbitrary code.

The primary flaw within HL1MDLLoader::read_meshes lies in the handling of array index variables parsed directly from the MDL binary stream. When the loader encounters model structures, it initializes several heap-allocated arrays, including temp_bones_ and bind_pose_vertices. These arrays hold vertex, bone, and transformation matrices crucial for skeletal animation and mesh reconstruction.

During parsing, the loader retrieves index values such as bone indices pvertbone[k] and skin references pskinref[pmesh->skinref] from the MDL file stream. These indices are subsequently utilized as offsets to access elements inside the heap-allocated structures without any boundary validation. Because the parser trusts the file header and structure counts, it assumes all indices lie within the safe limits of the pre-allocated buffers.

When a malformed MDL file defines index values larger than the actual array bounds, the application accesses memory outside the allocated block. This causes heap-out-of-bounds reads when reading bone transforms, and heap-out-of-bounds writes when writing calculated vertices back to memory buffers. This unchecked array indexing constitutes a classic CWE-122 (Heap-based Buffer Overflow) vulnerability, leading to memory corruption.

The vulnerability exists in assimp/code/AssetLib/MDL/HalfLife/HL1MDLLoader.cpp inside the read_meshes function. An analysis of the vulnerable commit b3a47a68fa0a379b1fa0788e4a5f448111cd2012 highlights multiple critical lines where indices are dereferenced without validation.

For example, the loader retrieves a bone index via pvertbone[k] and uses it to reference temp_bones_:

// Vulnerable code in HL1MDLLoader.cpp
bind_pose_vertices[k] = temp_bones_[pvertbone[k]].absolute_transform * aiVector3D(vert[0], vert[1], vert[2]);

If the value of pvertbone[k] exceeds the bounds of the temp_bones_ vector, this operation triggers an out-of-bounds read, fetching a corrupted matrix that corrupts subsequent calculations. Similarly, normal bone arrays are processed without verification:

// Vulnerable code in HL1MDLLoader.cpp
const aiMatrix4x4 normal_matrix = aiMatrix4x4(temp_bones_[pnormbone[k]].absolute_transform).Inverse().Transpose();

In addition, skin references are read through nested indexing operations:

// Vulnerable skin reference resolution
float texcoords_s_scale = 1.0f / (float)ptexture[pskinref[pmesh->skinref]].width;

If pmesh->skinref or the resolved value inside pskinref is larger than the ptexture allocation limits, the system attempts to dereference an invalid memory address, causing an immediate crash or leaking adjacent heap memory structures.

To trace the logical progression of the exploit, it is necessary to examine how Assimp structures its model loader sequence. The following diagram illustrates the flow of untrusted input data from the file stream into the heap buffers of the HL1MDLLoader class:

The parser begins by reading file headers to determine buffer sizes. It then allocates memory based on these dimensions. The failure occurs because individual element indices within the body of the MDL structure are not validated against the allocation sizes defined in the file headers.

To execute an attack, a local adversary must construct a malformed Half-Life MDL file containing inconsistent internal headers. The exploit file defines a small number of bone elements to minimize heap allocation size while setting the bone indices of specific vertices to extremely large integer values. This misalignment ensures that when the file is processed, the memory access offset points outside the allocated boundaries.

An application utilizing Assimp must then ingest this file. Typical targets include asset conversion servers, local 3D model viewers, game development environments, or engine pipelines. When the application loads the file, the parser executes automatically, requiring no direct administrative privileges or authentication from the attacking entity.

Depending on the configuration of the heap and the precision of the index alignment, the out-of-bounds access can overwrite adjacent heap chunks. This can corrupt function pointers, virtual table pointers, or metadata belonging to neighboring objects. Successfully aligning and manipulating these structures can redirect execution flow to attacker-controlled memory, enabling arbitrary code execution under the permissions of the host process.

The primary remediation strategy is upgrading the Assimp library. Since this vulnerability is tracked as part of a collective fuzzer issue, standard patches should be tracked directly via the project repository. If your application does not require importing Half-Life 1 MDL models, you should disable the vulnerable loader entirely during compilation.

To disable the legacy MDL importer, compile Assimp from source using the following CMake build configuration flag:

cmake -DASSIMP_BUILD_MDL_IMPORTER=OFF ..

This completely removes HL1MDLLoader and its associated attack surface from the compiled binary. For environments where the loader must remain active, implement robust sandboxing. Run the parsing process inside isolated sandboxes using gVisor, Docker, or systemd-seccomp profiles with restricted system call privileges to limit the impact of any potential sandbox escapes.