EUVD-2026-33566
GHSA-964j-jgrw-m572
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A security vulnerability has been detected in Assimp up to 6.0.4. Affected by this issue is the function HL1MDLLoader::read_sequence_infos of the file HL1MDLLoader.cpp of the component Half-Life 1 MDL Loader. The manipulation of the argument aiString leads to out-of-bounds read. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The project tagged the reported issue as bug.
AnalysisAI
Out-of-bounds read in Assimp's Half-Life 1 MDL Loader affects all versions up to 6.0.4, enabling a local low-privileged attacker to leak memory contents by supplying a crafted MDL file that triggers faulty bounds handling in the read_sequence_infos function of HL1MDLLoader.cpp. Impact is confined to partial confidentiality loss (C:L) with no integrity or availability consequences per the CVSS vector. A publicly available proof-of-concept exploit exists (POC disclosed via GitHub), though no active exploitation has been confirmed and this vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
Assimp (Open Asset Import Library) is an open-source C++ library used pervasively in game engines, 3D tooling, and graphics pipelines to import and normalize dozens of 3D model formats. The vulnerable component is its Half-Life 1 MDL format parser (HL1MDLLoader.cpp), specifically the read_sequence_infos function, which processes sequence metadata embedded in MDL files. The root cause class is CWE-125 (Out-of-Bounds Read): during parsing of the aiString argument - Assimp's internal fixed-length string type - the function reads beyond the valid buffer boundary, likely due to missing or incorrect length/offset validation against the raw file data. This class of bug in file parsers is well understood and frequently triggered via crafted malformed files. The CPE cpe:2.3:a:n/a:assimp:*:*:*:*:*:*:*:* covers all platforms where Assimp ≤ 6.0.4 is deployed. Tags include 'Buffer Overflow' alongside 'Information Disclosure,' suggesting the OOB read may be accompanied by memory layout concerns, though the CVSS impact scores do not reflect code execution potential.
RemediationAI
No vendor-released patched version has been independently confirmed from the available data - the project tagged the report as a bug (https://github.com/assimp/assimp/issues/6619) but no fix release is referenced in the intelligence sources. Monitor the official repository at https://github.com/assimp/assimp/ for an update beyond 6.0.4. As a compensating control, applications should avoid processing Half-Life 1 MDL files from untrusted sources using this library version; if HL1 MDL support is not required, disable or compile out the HL1MDLLoader component, which eliminates the attack surface entirely with no functional trade-off for non-HL1 workflows. For pipelines that must handle untrusted 3D files, run Assimp file parsing in an isolated process or container with no access to sensitive memory regions, limiting the impact of any OOB read to the sandboxed process.
An issue in assimp v.5.4.3 allows a local attacker to execute arbitrary code via the CallbackToLogRedirector function wi
Open Asset Import Library (assimp) commit 3c253ca was discovered to contain a segmentation violation via the component A
A heap-buffer-overflow vulnerability was discovered in the SkipSpacesAndLineEnd function in Assimp v5.4.3. Rated medium
A segmentation fault (SEGV) was detected in the SortByPTypeProcess::Execute function in the Assimp library during fuzz t
A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode function within the
A heap-buffer-overflow vulnerability has been identified in the OpenDDLParser::parseStructure function within the Assimp
A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. Rated medium severity (CV
A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic.h of the component CSM
A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. Rated medium severity (
A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3.cpp. Rated m
A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. Rated medium severity (CVSS
A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. Rated medium severity (
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today