CVE-2026-117608
Received Received - Intake

Integer Overflow in Assimp MD2Importer

Publication date: 2026-10-28

Last updated on: 2026-10-28

Assigner: VulnCheck

Description
Assimp through 6.0.5 contains an integer overflow vulnerability in MD2Importer::ValidateHeader() that allows attackers to bypass frame table bounds checks using crafted header fields. Attackers can supply a malicious .md2 file whose numFrames and numVertices values wrap the 32-bit size check, causing heap out-of-bounds reads that crash applications or expose adjacent heap memory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-28
Last Modified
2026-10-28
Generated
2026-10-28
AI Q&A
2026-10-28
EPSS Evaluated
N/A
NVD
CVE-2026-117608
EUVD
EUVD-2026-111543

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
assimp assimp 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-190 The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an integer overflow in the Assimp library's MD2Importer::ValidateHeader() function. Attackers can craft malicious .md2 files with manipulated numFrames and numVertices values that cause 32-bit integer wraparound during frame table bounds checks. This bypasses size validations, leading to heap out-of-bounds reads when the application processes the file.

Detection Guidance

To detect this vulnerability, monitor applications using Assimp for crashes when processing MD2 files. Use AddressSanitizer or similar tools to detect heap out-of-bounds reads during file import. Check for malformed MD2 files with specific header values like numVertices=131062 and numFrames=8192.

Impact Analysis

This vulnerability can crash applications using Assimp when processing crafted .md2 files. It may also expose adjacent heap memory, potentially leaking sensitive data or causing further instability. The impact depends on the application's context and whether AddressSanitizer or similar tools are enabled.

Mitigation Strategies

Update Assimp to a patched version that fixes the integer overflow in MD2Importer::ValidateHeader. If updating is not possible, disable MD2 file import functionality or block MD2 files at the network perimeter until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-117608. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart