Medium severity · published Aug 17, 2026
CVE-2026-19999
Open Asset Import Library Assimp 3DGS MDL7 Bone Transformation Key MDLLoader.cpp ParseBoneTrafoKeys_3DGS_MDL7 buffer overflow
6.3
CVSS
0.3%
EPSS
No
On KEV
Description
A security vulnerability has been detected in Open Asset Import Library Assimp Assimp 17c12da. The affected element is the function Assimp::MDLImporter::ParseBoneTrafoKeys_3DGS_MDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component 3DGS MDL7 Bone Transformation Key Parser. The manipulation of the argument transmatrix_count/pcBoneTransforms leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is 50d767984e78d51b53e2020fdf0967fd624bc377. It is recommended to apply a patch to fix this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Assimp · Open Asset Import Library Assimp
17c12da · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-19999
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-19999
github.com
https://github.com/assimp/assimp/commit/50d767984e78d51b53e2020fdf0967fd624bc377
github.com
https://github.com/assimp/assimp/issues/6633
github.com
https://github.com/assimp/assimp/pull/6759
github.com
https://github.com/user-attachments/files/27429337/poc.zip
vuldb.com
https://vuldb.com/cve/CVE-2026-19999
vuldb.com
https://vuldb.com/submit/873132
More from Assimp
9.8
CVE-2025-2152
A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3
8.8
CVE-2025-3015
A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3
8.8
CVE-2025-2757
A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3
8.8
CVE-2025-2756
A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3
8.8
CVE-2025-2755
A vulnerability was found in Open Asset Import Library Assimp 5.4.3