Integer Overflow Vulnerability in Assimp Affects OgreBinarySerializer
CVE-2026-129479
6.8MEDIUM
What is CVE-2026-129479?
An integer overflow vulnerability exists in the OgreBinarySerializer::ReadSubMesh function of Assimp up to version 6.0.6. This flaw allows an attacker to craft specially designed Ogre binary .mesh files, which can lead to the application crashing. By manipulating the index count, an attacker can exceed the bounds of a 32-bit buffer, resulting in a segmentation fault within the aiMesh destructor during scene teardown. This vulnerability poses a significant risk to application stability and requires immediate attention.
Affected Version(s)
assimp 0 <= 6.0.6