Medium severity · published Aug 17, 2026
CVE-2026-19970
Open Asset Import Library Assimp Node MDLLoader.cpp AddBonesToNodeGraph_3DGS_MDL7 heap-based overflow
6.3
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability was detected in Open Asset Import Library Assimp 17c12da. This affects the function Assimp::MDLImporter::AddBonesToNodeGraph_3DGS_MDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component Node Parser. The manipulation of the argument bones_num results in heap-based buffer overflow. The attack can be executed remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Assimp · Open Asset Import Library
17c12da · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-19970
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-19970
github.com
https://github.com/assimp/assimp/issues/6632
github.com
https://github.com/user-attachments/files/27428677/poc.zip
vuldb.com
https://vuldb.com/cve/CVE-2026-19970
vuldb.com
https://vuldb.com/submit/873131
vuldb.com
https://vuldb.com/vuln/391147
vuldb.com
https://vuldb.com/vuln/391147/cti
More from Assimp
9.8
CVE-2025-2152
A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3
8.8
CVE-2025-3015
A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3
8.8
CVE-2025-2757
A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3
8.8
CVE-2025-2756
A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3
8.8
CVE-2025-2755
A vulnerability was found in Open Asset Import Library Assimp 5.4.3