EUVD-2026-60017
GHSA-39wv-72w9-m7wp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
File must be opened by a user (UI:R); no authentication needed (PR:N); impact limited to low integrity and availability with no confidentiality exposure and no scope change.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
2DescriptionCVE.org
A security vulnerability has been detected in Open Asset Import Library Assimp 17c12da. The impacted element is the function Assimp::MDLImporter::GenerateOutputMeshes_3DGS_MDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component 3DGS MDL7 Model Output Mesh Generator. The manipulation leads to buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Buffer overflow in Open Asset Import Library (Assimp) commit 17c12da allows remote attackers to corrupt memory by delivering a maliciously crafted MDL7 3D model file to a victim application. The vulnerable function GenerateOutputMeshes_3DGS_MDL7 in MDLLoader.cpp fails to enforce buffer bounds during mesh generation, resulting in low-severity integrity and availability impact per CVSS 4.0 (score: 2.1). A public proof-of-concept exploit has been disclosed; no vendor patch exists as the project has not responded to the coordinated disclosure.
Technical ContextAI
Assimp (Open Asset Import Library) is an open-source C++ library for importing dozens of 3D model file formats, widely embedded in game engines, rendering pipelines, and graphics tools. The affected component is the 3DGS MDL7 Model Output Mesh Generator, specifically the function Assimp::MDLImporter::GenerateOutputMeshes_3DGS_MDL7 in code/AssetLib/MDL/MDLLoader.cpp. CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) identifies the root cause: the function does not adequately validate buffer boundaries when constructing output mesh geometry from MDL7 format input, allowing out-of-bounds write or read operations. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) indicates no special attack prerequisites beyond delivering the malicious file, though user interaction to open it is required. No CPE string was included in the provided data; the confirmed affected revision is commit 17c12da.
RemediationAI
No vendor-released patch has been identified at time of analysis; the Assimp project acknowledged the issue report at https://github.com/assimp/assimp/issues/6631 but has not responded with a fix or timeline. As a primary compensating control, applications using Assimp should disable processing of MDL7 format files entirely if the format is not required - this eliminates the vulnerable code path at zero functional cost for most deployments. For pipelines that must process MDL7 content, run Assimp-based file loading in a sandboxed subprocess with restricted OS privileges (e.g., seccomp on Linux, restricted integrity level on Windows) so that a successful overflow cannot escalate to broader system compromise; note this adds operational complexity and latency. Reject or quarantine MDL7 files sourced from untrusted external parties at the ingestion layer. Monitor the upstream GitHub issue for patch availability and apply it promptly once released. Building Assimp with memory-safe compiler flags (e.g., AddressSanitizer in testing, stack canaries and ASLR in production) can harden against exploitation of this class of bug.
Same weakness CWE-119 – Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today