Quick answers
- Is CVE-2026-19968 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-19968 being exploited in the wild.
- How severe is CVE-2026-19968?
- Medium severity, with a CVSS score of 4.3, published 17 August 2026.
- Which products and versions are affected?
- Assimp up to commit 09883e0 (before ee77bb09a42a49843ac85ef64c14d2328b251df1).
- Is there a fix for CVE-2026-19968?
- A patch was published on 2026-08-17: Patch ee77bb09a42a49843ac85ef64c14d2328b251df1 available on GitHub Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-19968 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-19968?
- Check whether you run Assimp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a heap-based buffer overflow in the ReadVSizedIntLWO2() helper function within the LWO2 model parser (code/AssetLib/LWO/LWOLoader.h). The function advances the file cursor by 2–4 bytes without validating that the cursor remains within the file buffer bounds. A malformed LWO2 file with a truncated polygon index section causes the parser to read out-of-bounds memory. The attack vector is network-based: any application using Assimp to parse untrusted model files is vulnerable without user interaction beyond loading the file. The patch (commit ee77bb0) adds bounds checking to guard every byte read against mFileBufferEnd and raises a DeadlyImportError on truncated input.
Affected products
- Assimp Assimp up to commit 09883e0 (before ee77bb09a42a49843ac85ef64c14d2328b251df1)
Timeline
- 2026-08-17: disclosed: Vulnerability published via NVD
- 2026-08-17: patched: Patch ee77bb09a42a49843ac85ef64c14d2328b251df1 available on GitHub