CVE-2026-82591

Received Received - Intake

Heap-based Buffer Overflow in Open Asset Import Library Assimp

Publication date: 2026-08-30

Last updated on: 2026-08-30

Assigner: VulDB

Description

A security vulnerability has been detected in Open Asset Import Library Assimp up to 6.0.2. The impacted element is the function MD5Importer::MakeDataUnique of the file code/AssetLib/MD5/MD5Loader.cpp. The manipulation of the argument iNewIndex leads to heap-based buffer overflow. The attack can only be performed from a local environment. The identifier of the patch is bf9dabb617c46e5133dac65cca6bff177917afcb. Applying a patch is the recommended action to fix this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-30

Last Modified

2026-08-30

Generated

2026-08-31

AI Q&A

2026-08-31

EPSS Evaluated

N/A

NVD

CVE-2026-82591

Affected Vendors & Products

Vendor	Product	Version / Range
assimp	open_asset_import_library	to 6.0.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-119	The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

This is a heap-based buffer overflow vulnerability in the Open Asset Import Library Assimp up to version 6.0.2. It occurs in the MD5Importer::MakeDataUnique function when the argument iNewIndex is manipulated. The attack requires local access to the system.

Detection Guidance

This vulnerability is specific to the Open Asset Import Library Assimp and requires local access to exploit. Detection may involve checking the installed version of Assimp and verifying if the vulnerable function MD5Importer::MakeDataUnique is present in the codebase.

Impact Analysis

An attacker with local access could exploit this to execute arbitrary code, crash the application, or gain elevated privileges on the affected system. It may lead to data corruption or unauthorized system access.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, potentially violating GDPR (data protection) or HIPAA (health data privacy) requirements. Organizations must address it to maintain compliance.

Mitigation Strategies

Update the Open Asset Import Library Assimp to version 6.0.2 or later. Apply the patch with identifier bf9dabb617c46e5133dac65cca6bff177917afcb to fix the heap-based buffer overflow in MD5Importer::MakeDataUnique.

Hi! I’m here to help you understand CVE-2026-82591. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70