Executive brief
Assimp is an open-source library used to import and process 3D model files in game engines and graphics applications. A heap-based buffer overflow vulnerability in the MDL model parser allows an attacker to overflow memory by crafting a malicious 3D model file, potentially leading to crashes, memory corruption, or arbitrary code execution when the file is loaded and processed.
Technical details
The vulnerability is a heap-based buffer overflow in the MDLImporter::AddBonesToNodeGraph_3DGS_MDL7 function within MDLLoader.cpp. The flaw is triggered by improper validation of the bones_num argument when parsing MDL (Quake engine) model files, allowing an attacker to write beyond allocated memory bounds. The attack requires an attacker to craft and serve a malicious MDL file; exploitation occurs when a victim application loads the file using Assimp. The attack is remotely exploitable with no authentication required, though it does require a user or application to explicitly load a crafted model file. A public proof-of-concept exploit is available. At time of disclosure, the Assimp project had not released a patch.
Affected products
- Assimp Assimp commit 17c12da and likely other versions
Timeline
- 2026-08-17: disclosed: CVE-2026-19970 published on NVD
- 2026-08-17: advisory: Public proof-of-concept exploit released