Log in Start free

Vulnerability · Published Aug 17, 2026 · Assigned by VulDB

CVE-2026-19969Open Asset Import Library Assimp 3DGS MDL7 Model Output Mesh Generator MDLLoader.cpp GenerateOutputMeshes_3DGS_MDL7 buffer overflow

Medium 5.4

In plain English

A medium-severity buffer overflow in Assimp from Open Asset Import Library. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.5%top 56.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in Open Asset Import Library Assimp 17c12da. The impacted element is the function Assimp::MDLImporter::GenerateOutputMeshes_3DGS_MDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component 3DGS MDL7 Model Output Mesh Generator. The manipulation leads to buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12assimpno fix listedDEBIAN-CVE-2026-19969
Debian:13assimpno fix listedDEBIAN-CVE-2026-19969
Debian:14assimpno fix listedDEBIAN-CVE-2026-19969
Ubuntu:22.04:LTSassimpno fix listedUBUNTU-CVE-2026-19969
Ubuntu:24.04:LTSassimpno fix listedUBUNTU-CVE-2026-19969
Ubuntu:26.04:LTSassimpno fix listedUBUNTU-CVE-2026-19969
Ubuntu:26.10assimpno fix listedUBUNTU-CVE-2026-19969

Affected products (as reported)

VendorProductVersions
Open Asset Import Library Assimp 17c12da

Weakness: CWE-120, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R

References