# CVE-2026-10233: Assimp out-of-bounds read in HL1MDLLoader

Source: https://junglewise.ai/threats/cve-2026-10233-assimp-out-of-bounds-read-in-hl1mdlloader  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-01. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2026-10233 · Severity: low · CVSS 3.3 · Published 2026-06-01

Assimp is a widely used library for importing various 3D model formats into applications. A security vulnerability in its Half-Life 1 MDL file loader could allow a local user to read sensitive information from the computer's memory that they should not have access to. This could potentially lead to the exposure of data from other processes or parts of the application using the library.

Technologies: [Assimp](https://junglewise.ai/threats/technologies/assimp). Vendors: [Assimp](https://junglewise.ai/threats/vendors/assimp).

## Quick answers

**Is CVE-2026-10233 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10233 being exploited in the wild.

**How severe is CVE-2026-10233?** Low severity, with a CVSS score of 3.3, published 1 June 2026.

**Which products and versions are affected?** Assimp up to 6.0.4.

**Is there a fix for CVE-2026-10233?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-10233 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-10233?** Check whether you run Assimp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds read vulnerability exists in Assimp versions up to 6.0.4 within the HL1MDLLoader::read_sequence_infos function in HL1MDLLoader.cpp. The flaw is triggered by improper handling of the aiString argument when processing Half-Life 1 MDL files. A local attacker can exploit this by providing a specially crafted MDL file, leading to an out-of-bounds memory access. This can result in the disclosure of sensitive information from the process memory. The issue has been publicly disclosed with a proof-of-concept available, though it is currently categorized as a bug by the maintainers.

## Affected products

- Assimp Assimp up to 6.0.4

## Timeline

- 2026-04-30: disclosed: Issue reported on GitHub repository
- 2026-06-01: advisory: CVE published and NVD record created

## References

- [https://github.com/assimp/assimp/](https://github.com/assimp/assimp/)
- [https://github.com/assimp/assimp/issues/6619](https://github.com/assimp/assimp/issues/6619)
- [https://github.com/user-attachments/files/27228962/poc.zip](https://github.com/user-attachments/files/27228962/poc.zip)
- [https://vuldb.com/cve/CVE-2026-10233](https://vuldb.com/cve/CVE-2026-10233)
- [https://vuldb.com/submit/821196](https://vuldb.com/submit/821196)
- [https://vuldb.com/vuln/367512](https://vuldb.com/vuln/367512)
- [https://vuldb.com/vuln/367512/cti](https://vuldb.com/vuln/367512/cti)

## Related threats

- [Assimp NULL pointer dereference in Ogre3D importer](https://junglewise.ai/threats/cve-2026-111128-assimp-through-6-0-5-contains-a-null-pointer-dereference)
- [Assimp out-of-bounds read in PLY file handler](https://junglewise.ai/threats/cve-2026-108573-a-vulnerability-was-detected-in-open-asset-import-library-assimp)
- [Assimp MDLImporter heap-based buffer overflow in AddBonesToNodeGraph](https://junglewise.ai/threats/cve-2026-19970-assimp-mdlimporter-heap-based-buffer-overflow-in)
- [Assimp MDL importer heap buffer overflow](https://junglewise.ai/threats/cve-2026-19969-assimp-mdl-importer-heap-buffer-overflow)
- [Assimp heap buffer overflow in LWO2 model parser](https://junglewise.ai/threats/cve-2026-19968-assimp-heap-buffer-overflow-in-lwo2-model-parser)