EUVD-2026-33562
GHSA-797q-3h4c-269w
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in Assimp up to 6.0.4. This affects the function HL1MDLLoader::read_meshes of the file HL1MDLLoader.cpp of the component Half-Life 1 MDL Loader. This manipulation causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. The project tagged the reported issue as bug.
AnalysisAI
Heap-based buffer overflow in Assimp's Half-Life 1 MDL Loader (HL1MDLLoader::read_meshes, versions through 6.0.4) allows local attackers with low privileges to trigger memory corruption when a crafted MDL file is processed, yielding partial confidentiality, integrity, and availability impact on the host process. A publicly available proof-of-concept exploit (poc.zip) has been disclosed, raising the urgency for affected deployments that ingest untrusted HL1 model files. No actively exploited status from CISA KEV has been confirmed; the Assimp project has tagged the report as a bug rather than a formal security advisory, and no patched release version has been identified at time of analysis.
Technical ContextAI
Assimp (Open Asset Import Library) is a widely used open-source C++ library that abstracts loading of dozens of 3D model formats for game engines, rendering pipelines, and content tools. The vulnerable code path lives in HL1MDLLoader.cpp, within the read_meshes function that parses mesh geometry data from Half-Life 1 MDL format model files. CWE-122 (Heap-based Buffer Overflow) indicates that the function fails to properly validate input-controlled size or count fields before writing to a heap-allocated buffer, permitting an out-of-bounds write. The CPE string cpe:2.3:a:n/a:assimp:*:*:*:*:*:*:*:* covers all Assimp releases up to and including 6.0.4. Because this code path is only activated when an application explicitly requests parsing of HL1 MDL files, the attack surface is narrowed to applications that handle this legacy format - though game modding tools, asset pipelines, and conversion utilities commonly do.
RemediationAI
No vendor-released patch with a confirmed fixed version number has been identified at time of analysis - the upstream fix, if any, should be tracked via the GitHub issue at https://github.com/assimp/assimp/issues/6614 and the repository at https://github.com/assimp/assimp/. Operators should monitor for a tagged release that addresses this issue and upgrade immediately upon availability. As a compensating control, applications that do not require Half-Life 1 MDL format support should disable or remove the HL1 loader code path entirely, which eliminates this attack surface with no functional trade-off for non-HL1 workflows. Applications that must process MDL files should enforce strict input validation - only accepting MDL files from trusted, integrity-verified sources - and consider sandboxing the Assimp parsing process (e.g., via seccomp, containers, or separate privilege-dropped processes) so that a successful overflow cannot escalate beyond the parsing subprocess. Blocking user-supplied or network-sourced MDL files at an application boundary is the most actionable short-term mitigation with the least operational side effect.
An issue in assimp v.5.4.3 allows a local attacker to execute arbitrary code via the CallbackToLogRedirector function wi
Open Asset Import Library (assimp) commit 3c253ca was discovered to contain a segmentation violation via the component A
A heap-buffer-overflow vulnerability was discovered in the SkipSpacesAndLineEnd function in Assimp v5.4.3. Rated medium
A segmentation fault (SEGV) was detected in the SortByPTypeProcess::Execute function in the Assimp library during fuzz t
A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode function within the
A heap-buffer-overflow vulnerability has been identified in the OpenDDLParser::parseStructure function within the Assimp
A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. Rated medium severity (CV
A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic.h of the component CSM
A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. Rated medium severity (
A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3.cpp. Rated m
A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. Rated medium severity (CVSS
A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. Rated medium severity (
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today