Heap-Based Buffer Overflow in Open Asset Import Library Assimp (17c12da)
CVE-2026-19970

5.3MEDIUM

Key Information:

Vendor: Open Asset Import Library
Status: Assimp
Vendor: CVE Published:; 17 August 2026

🔔 Create Open Asset Import Library Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-19970?

A vulnerability was identified within the Open Asset Import Library Assimp, specifically in the function Assimp::MDLImporter::AddBonesToNodeGraph_3DGS_MDL7 located in the MDLLoader.cpp file. This vulnerability arises from improper handling of the argument bones_num, leading to a potential heap-based buffer overflow. This issue can be exploited remotely, presenting a significant security concern. Despite early notification of the problem through a reported issue, the project maintainers have yet to address it or release a patch.

Affected Version(s)

Assimp 17c12da

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-19970 - Proof of Concept