CVE-2026-19999CWE-119CWE-120

CVE-2026-19999

Medium · published August 17, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
18.2
In the wild
Unconfirmed
What it is

A security vulnerability has been detected in Open Asset Import Library Assimp Assimp 17c12da. The affected element is the function Assimp::MDLImporter::ParseBoneTrafoKeys_3DGS_MDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component 3DGS MDL7 Bone Transformation Key Parser. The manipulation of the argument transmatrix_count/pcBoneTransforms leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is 50d767984e78d51b53e2020fdf0967fd624bc377. It is recommended to apply a patch to fix this issue.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00270 · 18.2th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2026-08-17T12:16Z
References (9)
https://vuldb.com/vuln/391200 · [email protected]https://vuldb.com/vuln/391200/cti · [email protected]https://github.com/assimp/assimp/commit/50d767984e78d51b53e2020fdf0967fd624bc377 · [email protected]https://github.com/assimp/assimp/issues/6633 · [email protected]https://github.com/assimp/assimp/pull/6759 · [email protected]https://github.com/user-attachments/files/27429337/poc.zip · [email protected]https://vuldb.com/cve/CVE-2026-19999 · [email protected]https://vuldb.com/submit/873132 · [email protected]https://github.com/assimp/assimp/issues/6633 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 17 AUG 07:30Z
    Open Asset Import Library Assimp 3DGS MDL7 Bone Transformation Key MDLLoader.cpp ParseBoneTrafoKeys_3DGS_MDL7 buffer overflow
    cvelistv5