A weakness has been identified in Open Asset Import Library Assimp 17c12da. The affected element is the function Assimp::MDLImporter::ReadFaces_3DGS_MDL7 in the library code/AssetLib/LWO/LWOLoader.h of the component 3DGS MDL7 Model Parser. Executing a manipulation can lead to heap-based buffer overflow.
The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. This patch is called ee77bb09a42a49843ac85ef64c14d2328b251df1.
Applying a patch is advised to resolve this issue.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
Passive
Minimal interaction
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 8
https://github.com/assimp/assimp/commit/ee77bb09a42a49843ac85ef64c14d2328b251df1
cna@vuldb.com
https://github.com/assimp/assimp/issues/6630
cna@vuldb.com
https://github.com/assimp/assimp/pull/6717
cna@vuldb.com
https://github.com/user-attachments/files/27425090/poc.zip
cna@vuldb.com
https://vuldb.com/cve/CVE-2026-19968
cna@vuldb.com
https://vuldb.com/submit/873129
cna@vuldb.com
https://vuldb.com/vuln/391145
cna@vuldb.com
https://vuldb.com/vuln/391145/cti
cna@vuldb.com