CVE-2026-19969

Open Asset Import Library Assimp 3DGS MDL7 Model Output Mesh Generator MDLLoader.cpp GenerateOutputMeshes_3DGS_MDL7 buffer overflow

No known exploitation. EPSS puts it in the 43rd percentile. No fix published yet.

CVSS 3.15.4Medium EPSS percentile43rd0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Check it yourself

OpenVAS · 1 check

e.g. OID 1.3.6.1.4.1.25623.1.1.9.2026.51021018010149

Run the check

Published 2026-08-17Updated 2026-08-20Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Open Asset Import Library AssimpAffected: 17c12daUpgrade to: not statedStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether any software you use (3D viewers, games, CAD tools, asset pipelines) relies on the Assimp library to load 3D model files.
If so, ask your software vendor or developer whether they bundle Assimp and if they are aware of this issue.
Avoid opening 3D model files (especially MDL7/3DGS format) from untrusted or unknown sources until this is resolved.
There is currently no official fixed version — ask your vendor to monitor the Assimp project for a patch and apply it as soon as one is released.

May need vendor or contractor work

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A security vulnerability has been detected in Open Asset Import Library Assimp 17c12da. The impacted element is the function Assimp::MDLImporter::GenerateOutputMeshes_3DGS_MDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component 3DGS MDL7 Model Output Mesh Generator. The manipulation leads to buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

In plain language

Written by AI from the record

A flaw in a 3D-model-reading library (Assimp) could crash an app when it opens a malicious 3D model file, but it requires someone to be tricked into opening the file and there's no sign attackers are using it — low concern for most small businesses.

A buffer overflow in Assimp's MDLImporter::GenerateOutputMeshes_3DGS_MDL7 function (MDLLoader.cpp), triggered when parsing a crafted 3DGS MDL7 model file, can corrupt memory and cause denial of service; no patch is currently available from the project.

If you're affected

Application crash
Service disruption
Possible app instability

What is it

Assimp is a tool many programs use behind the scenes to read 3D model files, similar to how a document viewer opens PDFs. This bug is like a corrupted file that, when opened by this tool, can make the program choke or misbehave rather than quietly loading. The risk only appears if someone actually opens the wrong file — it isn't something that happens automatically over the internet.

Who is affected

This matters to you if your business uses software that embeds the Assimp library to load 3D models — common in games, CAD tools, 3D viewers, and asset-conversion pipelines. It's only a risk if a user is tricked into opening a malicious 3D model file (MDL7/3DGS format) in that software; it does not trigger on its own.

How urgent is it

This is a low-urgency issue: there is no confirmed exploitation in the wild, no listing on any active-exploitation watchlist, and no public exploit code circulating. The impact is limited to a crash or minor instability (not data theft or full takeover), so routine caution — avoiding untrusted 3D model files — is sufficient for now.

What to do — in detail

Identify whether Assimp is a dependency in your application stack (check build manifests, vendored libraries, or ask your vendor) and whether the MDL/MDL7 importer is reachable (i.e., your application loads user-supplied 3D model files).
Review the affected code path: Assimp::MDLImporter::GenerateOutputMeshes_3DGS_MDL7 in code/AssetLib/MDL/MDLLoader.cpp — the overflow occurs during mesh generation from crafted MDL7 model data.
No official patch is currently available; the upstream Assimp project has been notified via issue report but has not yet responded or released a fix as of this writing.
As a temporary workaround, restrict or disable loading of untrusted MDL/MDL7 format 3D model files, or run model-import functionality in a sandboxed/isolated process to contain any crash or memory corruption.
Monitor the Assimp GitHub repository and advisories for a fix; subscribe to vulnerability trackers for this CVE to be alerted once a patched version is released.
No CISA KEV listing exists, so there is no mandated remediation deadline at this time.

Technical context

CVSS 3.1 score 5.4 (Medium), vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L — network-exploitable but requiring user interaction (opening a malicious file), with limited integrity and availability impact and no confidentiality impact. Weakness types are CWE-119 (improper restriction of operations within memory buffer bounds) and CWE-120 (classic buffer overflow / buffer copy without checking input size). EPSS predicts a low (~0.5%, 43rd percentile) likelihood of exploitation in the wild, with a flat trend, and this is not listed in CISA's Known Exploited Vulnerabilities catalog. No public exploit code or proof-of-concept has been observed, though press/community attention has been sustained. No vendor patch is currently available despite early disclosure to the project.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS43rd

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 43rd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

7 events over 66 days, from the signal feeds we watch.

2026-10-22OpenVAS check added
2026-08-20Record updated
2026-08-18Record updated
2026-08-17Publishedweakness classified, att&ck mapped, record updated

Affected products

Open Asset Import Libraryoss-projectaka assimp, assimp library
- AssimpLibraryOSS Libraries / generic-library

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Scored 5.4 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action