CVE-2026-19968

Open Asset Import Library Assimp 3DGS MDL7 Model LWOLoader.h ReadFaces_3DGS_MDL7 heap-based overflow

No known exploitation. EPSS puts it in the 31st percentile. No fix published yet.

CVSS 3.14.3Medium EPSS percentile31st0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Check it yourself

OpenVAS · 3 checks

e.g. OID 1.3.6.1.4.1.25623.1.1.5.2.2026.3994

Run the check

Published 2026-08-17Updated 2026-08-20Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Open Asset Import Library AssimpAffected: 17c12daUpgrade to: not statedStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your software uses the Assimp library to import 3D models (common in game engines, CAD tools, and 3D viewers).
If you don't know, ask your software vendor or developer whether Assimp is bundled in your product.
There is currently no official patched version published — ask your vendor when a fix will be available.
Until a fix exists, avoid opening 3D model files (especially MDL7/LWO format) from untrusted or unknown sources.
Once a fixed Assimp version is released, have your developer or vendor update to it promptly.

May need vendor or contractor work

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A weakness has been identified in Open Asset Import Library Assimp 17c12da. The affected element is the function Assimp::MDLImporter::ReadFaces_3DGS_MDL7 in the library code/AssetLib/LWO/LWOLoader.h of the component 3DGS MDL7 Model Parser. Executing a manipulation can lead to heap-based buffer overflow. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. This patch is called ee77bb09a42a49843ac85ef64c14d2328b251df1. Applying a patch is advised to resolve this issue.

In plain language

Written by AI from the record

A flaw in the Assimp 3D model-loading library can crash a program when it opens a specially crafted 3D model file, but there's no sign anyone is exploiting this, so it's a low-priority item for most small businesses.

Heap-based buffer overflow in Assimp::MDLImporter::ReadFaces_3DGS_MDL7 (3DGS MDL7 model parser) allows a crafted model file to corrupt heap memory and crash the consuming application, with no confirmed exploitation and no official fixed version yet available.

If you're affected

App or tool crash
Service interruption while processing files
Minor operational disruption

What is it

Assimp is a behind-the-scenes tool that lets software open and read many different 3D model file formats, a bit like a universal translator for 3D files. This bug means a booby-trapped model file could cause the program using Assimp to crash, similar to a corrupted document freezing your word processor — annoying, but not something that lets an attacker steal data or take over your system.

Who is affected

This matters to you only if a product you use or sell relies on the Assimp library to open 3D model files, such as game development tools, 3D asset viewers, or CAD-adjacent software. It's only a risk if the application actually opens untrusted, externally-sourced 3D model files (particularly in the MDL7/LWO format) — if your software never processes files from outside your organization, exposure is minimal.

How urgent is it

There is no evidence of active exploitation, no listing on government threat-tracking lists, and no public attack tool available, so this does not require urgent emergency action. You should still track it and plan to update once a vendor fix is released, but there's no need to disrupt operations today.

What to do — in detail

Confirm whether Assimp is embedded in your application stack (check dependency manifests, vendored libraries, or ask your software vendor directly) and whether the MDL7/LWO model loading path is reachable from user-supplied files. No official patched release version has been published yet per current findings, though a fix commit exists upstream (ee77bb09a42a49843ac85ef64c14d2328b251df1) — developers can cherry-pick or build from a commit after that fix lands in a tagged release. As a temporary workaround, avoid loading untrusted MDL7/LWO-format 3D model files, or run model-import functionality in a sandboxed/isolated process to limit crash impact. Monitor the Assimp GitHub repository for an official tagged release incorporating the fix, and re-check CISA KEV and vendor advisories periodically in case exploitation status changes.

Technical context

CVSS 4.3 (Medium), vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L — network-exploitable but requires user interaction (opening a crafted file), impacting only availability (crash), no confidentiality or integrity loss. Weakness class CWE-119/CWE-122 (improper buffer restriction / heap-based buffer overflow) in the 3DGS MDL7 model parser's ReadFaces_3DGS_MDL7 function. Not listed in CISA KEV; no public exploit code confirmed by current findings despite conflicting mentions in the raw description; EPSS predicts low likelihood of exploitation with a flat trend. A fix commit exists upstream but no official patched release version is confirmed yet. Press attention has been sustained, but this reflects research interest, not active attacker activity.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS31st

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.4% chance of exploitation activity in the next 30 days, which ranks it in the 31st percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

7 events over 66 days, from the signal feeds we watch.

2026-10-22OpenVAS check added
2026-08-20Record updated
2026-08-17Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Open Asset Import Libraryoss-projectaka assimp, assimp library
- AssimpLibraryOSS Libraries / generic-library

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Scored 4.3 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action