Heap-based Buffer Overflow in Open Asset Import Library Assimp Affects 3DGS MDL7 Model Parser
CVE-2026-19968

5.3MEDIUM

Key Information:

Vendor

Open Asset Import Library

Status
Assimp
Vendor
CVE Published:
17 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-19968?

A weakness exists within the Open Asset Import Library Assimp specifically related to the function Assimp::MDLImporter::ReadFaces_3DGS_MDL7. This vulnerability can potentially lead to a heap-based buffer overflow, allowing attackers to execute malicious code. The exploit can be initiated remotely, raising significant security concerns. A patch has been released to address this issue, and it is strongly recommended to apply the available fix to enhance security integrity.

Affected Version(s)

Assimp 17c12da

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-19968 - Proof of Concept

References

https://vuldb.com/vuln/391145
vdb-entrytechnical-description
https://vuldb.com/vuln/391145/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-19968
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

TYGLS (VulDB User)
.