Medium severity · published Aug 17, 2026
CVE-2026-19969
Open Asset Import Library Assimp 3DGS MDL7 Model Output Mesh Generator MDLLoader.cpp GenerateOutputMeshes_3DGS_MDL7 buffer overflow
5.4
CVSS
0.5%
EPSS
No
On KEV
Description
A security vulnerability has been detected in Open Asset Import Library Assimp 17c12da. The impacted element is the function Assimp::MDLImporter::GenerateOutputMeshes_3DGS_MDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component 3DGS MDL7 Model Output Mesh Generator. The manipulation leads to buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Assimp · Open Asset Import Library
17c12da · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-19969
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-19969
github.com
https://github.com/assimp/assimp/issues/6631
github.com
https://github.com/user-attachments/files/27425495/poc.zip
vuldb.com
https://vuldb.com/cve/CVE-2026-19969
vuldb.com
https://vuldb.com/submit/873130
vuldb.com
https://vuldb.com/vuln/391146
vuldb.com
https://vuldb.com/vuln/391146/cti
More from Assimp
9.8
CVE-2025-2152
A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3
8.8
CVE-2025-3015
A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3
8.8
CVE-2025-2757
A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3
8.8
CVE-2025-2756
A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3
8.8
CVE-2025-2755
A vulnerability was found in Open Asset Import Library Assimp 5.4.3
