Hi @nem0,

I found two memory-safety defects in the binary-FBX parser that are reachable from the public ofbx::load() entry point with attacker-controlled input (crafted .fbx file). I have reproducible PoCs and suggested fixes, but I don't want to post details publicly before a fix is available.

There's no SECURITY.md or private vulnerability reporting on this repo. Could you either:

1. Enable Private Vulnerability Reporting (repo Settings → Security → enable), which adds a "Report a vulnerability" button I can use, or
2. Share a security contact (email) I can send the full report to?

Happy to follow coordinated disclosure and hold the PoCs until a fix lands.
Thanks!