Skip to main content

Assimp CVE-2026-10233

| EUVD-2026-33566 LOW
Out-of-bounds Read (CWE-125)
2026-06-01 VulDB GHSA-964j-jgrw-m572
Information Disclosure Buffer Overflow Assimp
1.9
CVSS 4.0 · NVD

Severity by source

NVD PRIMARY
1.9 LOW
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
CVSS changed
Jun 01, 2026 - 08:22 NVD
3.3 (LOW) 1.9 (LOW)
Analysis Generated
Jun 01, 2026 - 07:51 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in Assimp up to 6.0.4. Affected by this issue is the function HL1MDLLoader::read_sequence_infos of the file HL1MDLLoader.cpp of the component Half-Life 1 MDL Loader. The manipulation of the argument aiString leads to out-of-bounds read. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The project tagged the reported issue as bug.

AnalysisAI

Out-of-bounds read in Assimp's Half-Life 1 MDL Loader affects all versions up to 6.0.4, enabling a local low-privileged attacker to leak memory contents by supplying a crafted MDL file that triggers faulty bounds handling in the read_sequence_infos function of HL1MDLLoader.cpp. Impact is confined to partial confidentiality loss (C:L) with no integrity or availability consequences per the CVSS vector. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Gain local low-privilege access
Delivery
Place crafted HL1 MDL file in application-accessible path
Exploit
Application invokes Assimp HL1MDLLoader
Execution
read_sequence_infos processes malformed aiString
Persist
Out-of-bounds read leaks adjacent memory
Impact
Attacker retrieves disclosed memory contents
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Local access with low operating-system privileges is required (CVSS AV:L/PR:L). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The base CVSS 3.1 score of 3.3 (Low) accurately reflects constrained real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A local attacker with standard user privileges places a crafted Half-Life 1 MDL file - constructed using the publicly available POC (https://github.com/user-attachments/files/27228962/poc.zip) - into a location processed by a target application using Assimp ≤ 6.0.4, such as a 3D editor, game asset pipeline, or conversion tool. When the application loads the file, `read_sequence_infos` reads beyond the intended buffer boundary for the `aiString` argument, potentially exposing adjacent heap or stack memory contents to the attacker. …
Remediation No vendor-released patched version has been independently confirmed from the available data - the project tagged the report as a bug (https://github.com/assimp/assimp/issues/6619) but no fix release is referenced in the intelligence sources. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

Share

CVE-2026-10233 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy