Description
A vulnerability was detected in Open Asset Import Library Assimp 17c12da. This affects the function Assimp::MDLImporter::AddBonesToNodeGraph_3DGS_MDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component Node Parser. The manipulation of the argument bones_num results in heap-based buffer overflow. The attack can be executed remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-08-17
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability originates from improper handling of the bones_num parameter in the Assimp MDLImporter, causing a heap‑based buffer overflow in MDLLoader.cpp. This flaw allows an attacker to corrupt memory, potentially leading to application crash or execution of arbitrary code. The overflow is linked to the buffer size being overwritten during bone graph construction, as highlighted by CWE‑119 and CWE‑122.

Affected Systems

This issue affects the Open Asset Import Library (Assimp) at commit 17c12da. Systems that process MDL files using this version of Assimp are at risk. The CVE references indicate the flaw was discovered in that specific release, and there is no patch listed for earlier versions.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, and the public exploit is available, demonstrating remote exploitation potential. The EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalog. Attackers could supply a crafted MDL file to trigger the overflow. Because the flaw is in a common library used by 3D applications, a broad range of end‑systems could be impacted.

Generated by OpenCVE AI on August 17, 2026 at 03:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Verify if an updated Assimp release includes a fix for the MDLImporter buffer overflow and upgrade accordingly
  • If no patch is available, implement input validation or sandboxing for MDL file imports to prevent exploitation
  • Apply runtime mitigations such as address space layout randomization and stack canaries, and monitor application logs for abnormal memory access patterns

Generated by OpenCVE AI on August 17, 2026 at 03:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 17 Aug 2026 02:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in Open Asset Import Library Assimp 17c12da. This affects the function Assimp::MDLImporter::AddBonesToNodeGraph_3DGS_MDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component Node Parser. The manipulation of the argument bones_num results in heap-based buffer overflow. The attack can be executed remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Title Open Asset Import Library Assimp Node MDLLoader.cpp AddBonesToNodeGraph_3DGS_MDL7 heap-based overflow
First Time appeared Assimp
Assimp assimp
Weaknesses CWE-119
CWE-122
CPEs cpe:2.3:a:assimp:assimp:*:*:*:*:*:*:*:*
Vendors & Products Assimp
Assimp assimp
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Assimp Assimp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-17T01:15:11.322Z

Reserved: 2026-08-16T07:50:25.109Z

Link: CVE-2026-19970

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-17T02:16:41.033

Modified: 2026-08-17T02:16:41.033

Link: CVE-2026-19970

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-17T03:30:12Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-122

    Heap-based Buffer Overflow