Heap Out-of-Bounds Read Vulnerability in Assimp Affected by MD2 Importer

CVE-2026-129480

What is CVE-2026-129480?

The vulnerability allows attackers to exploit a flaw in the MD2Importer of Assimp version 6.0.6, leading to a potential heap out-of-bounds read. By providing a specially crafted .md2 file with an unvalidated 'frameSize' header, an attacker can intentionally read beyond the allocated buffer. This could not only crash the application but may also allow the member adjacent to the heap memory buffer to be leaked. The issue highlights the importance of validating header fields during file loading operations to prevent unauthorized access and ensure application stability.

References