Description

A security vulnerability has been detected in Open Asset Import Library Assimp 17c12da. The impacted element is the function Assimp::MDLImporter::GenerateOutputMeshes_3DGS_MDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component 3DGS MDL7 Model Output Mesh Generator. The manipulation leads to buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-17T01:16:44.727Z",
  "pubdate": "2026-08-17T01:16:44.727Z",
  "executiveSummary": "A buffer overflow vulnerability has been identified in the Open Asset Import Library (Assimp) version 17c12da.\nThe vulnerability resides within the 3DGS MDL7 Model Output Mesh Generator component, specifically inside the function Assimp::MDLImporter::GenerateOutputMeshes_3DGS_MDL7 located in the file code/AssetLib/MDL/MDLLoader.cpp.\nAn unauthenticated remote attacker can exploit this flaw by supplying a specially crafted 3DGS MDL7 model file to an application utilizing the Assimp library for parsing.\nSuccessful exploitation of this vulnerability leads to a buffer overflow condition, which may result in arbitrary code execution, application crashes, or memory corruption within the context of the running process.\nThe attack vector is network-based via file parsing, requiring the victim to process a malicious file.\nPublic disclosure of the exploit increases the risk of active exploitation, and the vendor has not yet responded or provided an official patch to remediate the issue.",
  "technicalDetails": "The vulnerability is caused by an improper bounds check or memory allocation issue within the Assimp::MDLImporter::GenerateOutputMeshes_3DGS_MDL7 function in code/AssetLib/MDL/MDLLoader.cpp.\nDuring the parsing and generation of output meshes for 3DGS MDL7 files, the function processes geometry or index data defined within the input file structure.\nIf the input file contains maliciously manipulated metadata, header values, or vertex counts that do not align with the actual allocated buffer sizes, writing data based on these untrusted dimensions causes a heap-based or stack-based buffer overflow.\nAttack flow begins when an application utilizes Assimp to import an untrusted 3D model file supplied by a remote user.\nThe parsing logic invokes the vulnerable GenerateOutputMeshes_3DGS_MDL7 routine to interpret the MDL7 model format.\nAs the parser extracts malicious structures from code/AssetLib/MDL/MDLLoader.cpp, it writes data past the boundaries of the pre-allocated memory buffer.\nThis overwrites adjacent memory structures, potentially hijacking control flow or causing an immediate denial of service through segmentation faults or memory access violations.\nThe vulnerability requires no authentication or special privileges from the attacker, provided the target application processes the malformed remote input.\nPost-exploitation impact depends on the memory layout and heap/stack protections of the host application, ranging from localized application crashes to arbitrary remote code execution under the privileges of the user running the affected software."
}