Heap-Based Buffer Overflow in Open Asset Import Library Assimp
CVE-2026-19967

5.3MEDIUM

Key Information:

Vendor: Open Asset Import Library
Status: Assimp
Vendor: CVE Published:; 17 August 2026

🔔 Create Open Asset Import Library Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-19967?

A security flaw has been identified in the Open Asset Import Library Assimp, specifically within the Assimp::Compression::decompressBlock function in the Common/Compression.cpp file. This vulnerability may allow an attacker to exploit a heap-based buffer overflow through manipulation of the input data. The potential for remote exploitation raises significant concerns, and although the issue was reported to the project early on, a response from the developers has yet to be received. The exploit has already been disseminated publicly, making it imperative for users and developers alike to take necessary precautions.

Affected Version(s)

Assimp 17c12da

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-19967 - Proof of Concept