EUVD-2026-33563
GHSA-h6wx-qjrr-x3rf
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in Assimp up to 6.0.4. This impacts the function Assimp::MDL::HalfLife::HL1MDLLoader::read_animations of the file HL1MDLLoader.cpp of the component Half-Life 1 MDL Loader. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit is publicly available and might be used. The project tagged the reported issue as bug.
AnalysisAI
Heap-based buffer overflow in Assimp's Half-Life 1 MDL Loader (versions up to 6.0.4) allows a locally authenticated attacker with low privileges to corrupt heap memory via a crafted MDL animation file, producing low-severity but confirmed confidentiality, integrity, and availability impact. The vulnerability resides in the read_animations function of HL1MDLLoader.cpp and is reproducible with publicly available exploit code (POC). This is not confirmed in CISA KEV, and the Assimp project has tagged the report as a bug rather than a security defect, which may slow patch prioritization.
Technical ContextAI
Assimp (Open Asset Import Library) is a widely used open-source C++ library that supports importing dozens of 3D model file formats, including Half-Life 1 MDL. The affected component, HL1MDLLoader.cpp, handles parsing of MDL animation data via Assimp::MDL::HalfLife::HL1MDLLoader::read_animations. CWE-122 (Heap-based Buffer Overflow) identifies the root cause class: when processing animation records from a malformed MDL file, the function writes past the bounds of a heap-allocated buffer without adequate length validation, corrupting adjacent heap memory. The CPE string cpe:2.3:a:n/a:assimp:*:*:*:*:*:*:*:* covers all Assimp versions up to and including 6.0.4, with the vendor field listed as 'n/a' in NVD metadata, indicating limited official vendor attribution in the advisory databases.
RemediationAI
No vendor-released patched version has been independently confirmed at time of analysis. The upstream issue is tracked at https://github.com/assimp/assimp/issues/6615 - monitor this thread for any fix commits or tagged releases. As compensating controls: disable or conditionally compile the Half-Life 1 MDL Loader if MDL file support is not required by the application (note: this may break existing MDL-dependent workflows); restrict the file types accepted by any Assimp-consuming application to only those formats actively needed, reducing attack surface; sandbox the process performing Assimp file parsing using OS-level mechanisms (e.g., seccomp on Linux, AppContainer on Windows) to limit the consequence of heap corruption to the sandboxed process; and treat all MDL files from untrusted sources as hostile input. Do not rely on AV scanning alone, as crafted binary model files are rarely detected by signature-based tools.
An issue in assimp v.5.4.3 allows a local attacker to execute arbitrary code via the CallbackToLogRedirector function wi
Open Asset Import Library (assimp) commit 3c253ca was discovered to contain a segmentation violation via the component A
A heap-buffer-overflow vulnerability was discovered in the SkipSpacesAndLineEnd function in Assimp v5.4.3. Rated medium
A segmentation fault (SEGV) was detected in the SortByPTypeProcess::Execute function in the Assimp library during fuzz t
A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode function within the
A heap-buffer-overflow vulnerability has been identified in the OpenDDLParser::parseStructure function within the Assimp
A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. Rated medium severity (CV
A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic.h of the component CSM
A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. Rated medium severity (
A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3.cpp. Rated m
A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. Rated medium severity (CVSS
A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. Rated medium severity (
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today