Heap Out-of-Bounds Read Vulnerability in Assimp Software by Assimp
CVE-2026-129478

6.9MEDIUM

Key Information:

Vendor: Assimp
Status: Assimp
Vendor: CVE Published:; 15 November 2026

What is CVE-2026-129478?

The Assimp software, specifically version 6.0.6, is vulnerable to a heap out-of-bounds read due to an error in glTFCommon::Util::ParseDataURI. This vulnerability arises from storing the data offset as a signed char, allowing attackers to craft malicious glTF files with specially designed raw data URIs. If the data segment exceeds byte 127, it can lead to application crashes or unauthorized disclosure of adjacent heap memory, posing significant security risks.