Executive brief
Assimp is a popular open-source 3D model import library used by game engines and graphics applications. A heap buffer overflow vulnerability in the 3DGS MDL7 model file parser allows an attacker to craft a malicious model file that, when loaded by an application using Assimp, causes out-of-bounds memory writes. This can lead to denial of service, memory corruption, or potentially code execution.
Technical details
A heap buffer overflow exists in the Assimp::MDLImporter::GenerateOutputMeshes_3DGS_MDL7 function in code/AssetLib/MDL/MDLLoader.cpp at line 1944. The vulnerability is triggered during 3DGS MDL7 model file parsing when a loop index (iCurrent) exceeds the bounds of an allocated array (pcMesh->mBones), causing out-of-bounds writes. The attack vector is network-based: a remote attacker can craft a malicious .mdl file and supply it to an application that uses Assimp for model loading, without requiring authentication or user interaction. The PoC has been disclosed publicly. No patch has been released at the time of advisory publication.
Affected products
- Assimp Assimp 17c12da
Timeline
- 2026-08-17: disclosed