Assimp CVE-2026-82591

The vulnerability is triggered when Assimp processes a crafted MD5 mesh file (.md5mesh) in which the number of original declared vertices exceeds the number of face-corner index slots (mFaces.size() × 3). The attacker must supply or place a malformed MD5 mesh file that is subsequently loaded by an application embedding Assimp - no special runtime configuration flag or non-default setting is required; any deployment that imports MD5 format files is vulnerable. Exploitation is limited to local environments (AV:L per CVSS 4.0), meaning network-based delivery requires a prior file-write primitive. Low privilege is sufficient (PR:L) - no administrator or elevated rights are needed. The constraint that a crafted file must reach the loader path makes mass automated exploitation infeasible; the realistic threat actors are insiders or attackers who have already achieved local access.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) scores 4.8, reflecting a strictly local attack path with low-privilege requirements and constrained impact across confidentiality, integrity, and availability. No EPSS data was provided in the source intelligence, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV, and no POC has been reported, indicating no confirmed or publicly demonstrated exploitation at time of analysis. Real-world risk is further narrowed by the requirement that a crafted MD5 mesh file reach the Assimp loader - practical attack surfaces are game editors, content-creation pipelines, and modding tools that accept externally supplied assets. Mass automated exploitation is not feasible given the local-only attack vector. The moderate CVSS score accurately reflects the limited blast radius rather than understating a high-risk issue.

A local attacker with low-privilege access to a system running a game editor or 3D asset pipeline that embeds Assimp places a crafted .md5mesh file - constructed with more declared original vertices than face-corner slots - in a directory monitored for asset imports. When the application invokes Assimp's MD5 importer on the file, MakeDataUnique() underestimates the required buffer and writes vertex data past the heap allocation boundary, potentially enabling arbitrary code execution under the application's process context or causing a denial-of-service crash. No public POC is available at time of analysis.