Executive brief
Assimp is a widely used library for importing various 3D model formats into applications. A security vulnerability in its Half-Life 1 MDL file loader could allow a local user to read sensitive information from the computer's memory that they should not have access to. This could potentially lead to the exposure of data from other processes or parts of the application using the library.
Technical details
An out-of-bounds read vulnerability exists in Assimp versions up to 6.0.4 within the HL1MDLLoader::read_sequence_infos function in HL1MDLLoader.cpp. The flaw is triggered by improper handling of the aiString argument when processing Half-Life 1 MDL files. A local attacker can exploit this by providing a specially crafted MDL file, leading to an out-of-bounds memory access. This can result in the disclosure of sensitive information from the process memory. The issue has been publicly disclosed with a proof-of-concept available, though it is currently categorized as a bug by the maintainers.
Affected products
- Assimp Assimp up to 6.0.4
Timeline
- 2026-04-30: disclosed: Issue reported on GitHub repository
- 2026-06-01: advisory: CVE published and NVD record created