CVE-2026-19999 in Assimp
Summary
by MITRE • 08/17/2026
A security vulnerability has been detected in Open Asset Import Library Assimp Assimp 17c12da. The affected element is the function Assimp::MDLImporter::ParseBoneTrafoKeys_3DGS_MDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component 3DGS MDL7 Bone Transformation Key Parser. The manipulation of the argument transmatrix_count/pcBoneTransforms leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is 50d767984e78d51b53e2020fdf0967fd624bc377. It is recommended to apply a patch to fix this issue.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/17/2026
The Open Asset Import Library, commonly known as Assimp, serves as a critical open-source library for developers seeking to import various 3D file formats into their applications. A significant security vulnerability has been identified within the MDL importer component, specifically affecting version associated with commit hash 17c12da. The flaw resides in the function Assimp::MDLImporter::ParseBoneTrafoKeys_3DGS_MDL7 located in the source code file code/AssetLib/MDL/MDLLoader.cpp. This particular module is responsible for parsing bone transformation keys within the 3DGS MDL7 format, a structure commonly used in game development and 3D modeling workflows. The vulnerability arises from improper validation of input data during the processing of these transformation matrices, creating an opportunity for attackers to exploit memory management errors when handling untrusted or malformed asset files.
The core technical flaw is classified as a buffer overflow, which corresponds to CWE-120 in the Common Weakness Enumeration standard. This issue occurs due to the manipulation of the transmatrix_count and pcBoneTransforms arguments passed into the parsing function. When an attacker provides a crafted MDL file where these parameters are manipulated beyond expected bounds, the library fails to perform adequate boundary checks before copying data into fixed-size buffers. Consequently, this allows for writing data past the allocated memory region, leading to heap or stack corruption depending on the specific execution context and compiler optimizations. This type of error is particularly dangerous because it can lead to arbitrary code execution if an attacker can control the overwritten memory contents, such as function pointers or return addresses, thereby gaining full control over the host application running Assimp.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1203, which covers Exploitation for Client Execution, particularly when targeting software that processes external assets like 3D models. The operational impact of this flaw is severe because it can be initiated remotely if the vulnerable application accepts user-uploaded files or loads untrusted content from network sources without proper sanitization. Since Assimp is widely integrated into game engines, CAD software, and visualization tools, an attacker could distribute a maliciously crafted MDL file via phishing emails, compromised websites, or shared repositories. Upon opening this file in a vulnerable application, the buffer overflow would trigger, potentially allowing remote code execution with the privileges of the user running the application. The fact that public exploits have been disclosed significantly increases the risk landscape, as automated scanning tools and malicious actors can readily leverage these proofs of concept to target unpatched systems without needing to develop custom exploit code from scratch.
The patch identifier 50d767984e78d51b53e2020fdf0967fd624bc377 addresses this vulnerability by implementing stricter input validation and bounds checking within the ParseBoneTrafoKeys_3DGS_MDL7 function. This fix ensures that the transmatrix_count is validated against expected limits before any memory allocation or copy operations occur, thereby preventing the overflow condition. To mitigate this risk effectively, organizations and developers must immediately apply the recommended patch to their Assimp dependencies. For end-users of applications utilizing Assimp, it is crucial to ensure that the underlying software they use has been updated by its vendor to include these security fixes. Additionally, implementing defense-in-depth strategies such as sandboxing 3D viewing applications, disabling macro execution in documents containing embedded assets, and employing memory protection mechanisms like ASLR and DEP can help reduce the likelihood of successful exploitation even if a vulnerability is present. Regular auditing of third-party libraries used in software supply chains remains essential to maintain robust security postures against evolving threats targeting asset parsing components.