CVE-2026-19969
Received Received - Intake

Buffer Overflow in Open Asset Import Library Assimp

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulDB

Description
A security vulnerability has been detected in Open Asset Import Library Assimp 17c12da. The impacted element is the function Assimp::MDLImporter::GenerateOutputMeshes_3DGS_MDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component 3DGS MDL7 Model Output Mesh Generator. The manipulation leads to buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-19969
EUVD
EUVD-2026-60017

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
assimp assimp *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-120 The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a heap-buffer-overflow in the Open Asset Import Library Assimp. It occurs in the function Assimp::MDLImporter::GenerateOutputMeshes_3DGS_MDL7 when processing MDL files. The issue involves an out-of-bounds write to the pcMesh->mBones array when the loop index exceeds the allocated size of 6, leading to memory corruption.

Detection Guidance

To detect this vulnerability, you can use AddressSanitizer (ASAN) to identify heap-buffer-overflow issues. Compile the Assimp library with ASAN enabled and run fuzz testing using a proof-of-concept MDL file. This will trigger the overflow in the Assimp::MDLImporter::GenerateOutputMeshes_3DGS_MDL7 function.

Impact Analysis

The vulnerability allows remote attackers to execute arbitrary code or cause a denial of service by exploiting the buffer overflow. Since the exploit is publicly disclosed, attackers may use it to compromise systems processing MDL files with the vulnerable Assimp library.

Compliance Impact

This vulnerability, a heap-buffer-overflow in the Assimp library's MDLImporter module, could lead to memory corruption and potential arbitrary code execution. For compliance with standards like GDPR or HIPAA, such vulnerabilities may result in unauthorized data access or processing, violating data integrity and confidentiality requirements. Organizations using affected software must assess exposure and implement mitigations to maintain compliance.

Mitigation Strategies

Immediate mitigation steps include updating the Assimp library to the latest version once a patch is released. Until then, avoid processing untrusted MDL files and implement input validation to prevent malformed files from being processed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19969. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart