Log in Start free

Vulnerability · Published Aug 17, 2026 · Assigned by VulDB

CVE-2026-19999Open Asset Import Library Assimp 3DGS MDL7 Bone Transformation Key MDLLoader.cpp ParseBoneTrafoKeys_3DGS_MDL7 buffer overflow

Medium 6.3

In plain English

A medium-severity buffer overflow in Assimp from Open Asset Import Library Assimp. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.3%top 80.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in Open Asset Import Library Assimp Assimp 17c12da. The affected element is the function Assimp::MDLImporter::ParseBoneTrafoKeys_3DGS_MDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component 3DGS MDL7 Bone Transformation Key Parser. The manipulation of the argument transmatrix_count/pcBoneTransforms leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is 50d767984e78d51b53e2020fdf0967fd624bc377. It is recommended to apply a patch to fix this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12assimpno fix listedDEBIAN-CVE-2026-19999
Debian:13assimpno fix listedDEBIAN-CVE-2026-19999
Debian:14assimpno fix listedDEBIAN-CVE-2026-19999
Ubuntu:22.04:LTSassimpno fix listedUBUNTU-CVE-2026-19999
Ubuntu:24.04:LTSassimpno fix listedUBUNTU-CVE-2026-19999
Ubuntu:26.04:LTSassimpno fix listedUBUNTU-CVE-2026-19999
Ubuntu:26.10assimpno fix listedUBUNTU-CVE-2026-19999

Affected products (as reported)

VendorProductVersions
Open Asset Import Library Assimp Assimp 17c12da

Weakness: CWE-120, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

References