CVE-2026-82591CWE-119CWE-122

CVE-2026-82591

Medium · published August 31, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
6.2
In the wild
Unconfirmed
What it is

A security vulnerability has been detected in Open Asset Import Library Assimp up to 6.0.2. The impacted element is the function MD5Importer::MakeDataUnique of the file code/AssetLib/MD5/MD5Loader.cpp. The manipulation of the argument iNewIndex leads to heap-based buffer overflow. The attack can only be performed from a local environment. The identifier of the patch is bf9dabb617c46e5133dac65cca6bff177917afcb. Applying a patch is the recommended action to fix this issue.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
4.8 · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
EPSS
0.00172 · 6.2th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-122 · Heap-based Buffer Overflow
Published
2026-08-31T03:17Z
References (6)
https://github.com/assimp/assimp/commit/bf9dabb617c46e5133dac65cca6bff177917afcb · [email protected]https://github.com/assimp/assimp/pull/6718 · [email protected]https://vuldb.com/cve/CVE-2026-82591 · [email protected]https://vuldb.com/submit/892413 · [email protected]https://vuldb.com/vuln/397086 · [email protected]https://vuldb.com/vuln/397086/cti · [email protected]
EPSS history
Timeline
  • 01 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 30 AUG 22:45Z
    Open Asset Import Library Assimp MD5Loader.cpp MakeDataUnique heap-based overflow
    cvelistv5