Vulnerability · Published Aug 30, 2026 · Assigned by VulDB
CVE-2026-82591Open Asset Import Library Assimp MD5Loader.cpp MakeDataUnique heap-based overflow
Medium 5.3
In plain English
A medium-severity heap buffer overflow in Assimp from Open Asset Import Library. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).
Official description
A security vulnerability has been detected in Open Asset Import Library Assimp up to 6.0.2. The impacted element is the function MD5Importer::MakeDataUnique of the file code/AssetLib/MD5/MD5Loader.cpp. The manipulation of the argument iNewIndex leads to heap-based buffer overflow. The attack can only be performed from a local environment. The identifier of the patch is bf9dabb617c46e5133dac65cca6bff177917afcb. Applying a patch is the recommended action to fix this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | assimp | no fix listed | DEBIAN-CVE-2026-82591 |
| Debian:13 | assimp | no fix listed | DEBIAN-CVE-2026-82591 |
| Debian:14 | assimp | no fix listed | DEBIAN-CVE-2026-82591 |
| Ubuntu:22.04:LTS | assimp | no fix listed | UBUNTU-CVE-2026-82591 |
| Ubuntu:24.04:LTS | assimp | no fix listed | UBUNTU-CVE-2026-82591 |
| Ubuntu:26.04:LTS | assimp | no fix listed | UBUNTU-CVE-2026-82591 |
| Ubuntu:26.10 | assimp | no fix listed | UBUNTU-CVE-2026-82591 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Open Asset Import Library | Assimp | 6.0.06.0.16.0.2 |
Weakness: CWE-122, CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C
References
- VDB-397086 | Open Asset Import Library Assimp MD5Loader.cpp MakeDataUnique heap-based overflow vdb-entry, technical-description
- VDB-397086 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- CVE-2026-82591 | CVE Analysis and Report third-party-advisory
- Submit #892413 | assimp Open Asset Import Library (assimp) 6.0.2 Heap-based Buffer Overflow (CWE-122) third-party-advisory
- https://github.com/assimp/assimp/pull/6718 issue-tracking, patch
- https://github.com/assimp/assimp/commit/bf9dabb617c46e5133dac65cca6bff177917afcb patch