Description

A security vulnerability has been detected in Open Asset Import Library Assimp Assimp 17c12da. The affected element is the function Assimp::MDLImporter::ParseBoneTrafoKeys_3DGS_MDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component 3DGS MDL7 Bone Transformation Key Parser. The manipulation of the argument transmatrix_count/pcBoneTransforms leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is 50d767984e78d51b53e2020fdf0967fd624bc377. It is recommended to apply a patch to fix this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-17T08:16:59.733Z",
  "pubdate": "2026-08-17T08:16:59.733Z",
  "executiveSummary": "A buffer overflow vulnerability has been identified in Open Asset Import Library Assimp Assimp 17c12da, specifically within the 3DGS MDL7 Bone Transformation Key Parser component.\nThe vulnerability resides in the function Assimp::MDLImporter::ParseBoneTrafoKeys_3DGS_MDL7 located in code/AssetLib/MDL/MDLLoader.cpp.\nThis flaw can be triggered remotely by manipulating the transmatrix_count or pcBoneTransforms arguments during the parsing of maliciously crafted MDL7 files.\nSuccessful exploitation of this vulnerability can lead to memory corruption, potentially resulting in arbitrary code execution or a denial of service (application crash).\nGiven that exploits have been publicly disclosed, the risk to systems processing untrusted 3D model files is critical.\nNo specific authentication or elevated privileges are required to initiate the attack, as long as a victim can be induced to process a malformed file remotely or locally.",
  "technicalDetails": "The vulnerability is caused by an improper bounds check or integer handling when parsing bone transformation keys in the Assimp::MDLImporter::ParseBoneTrafoKeys_3DGS_MDL7 function within code/AssetLib/MDL/MDLLoader.cpp.\nThe component responsible for parsing 3DGS MDL7 bone transformation keys fails to properly validate the relationship between the declared transmatrix_count and the actual memory allocated for pcBoneTransforms.\nWhen a specially crafted MDL file containing malicious or out-of-bounds size indicators is supplied, the parser writes data past the boundaries of the allocated heap or stack buffer, resulting in a buffer overflow.\nThe attack flow begins when an application utilizing the Open Asset Import Library attempts to load and parse an untrusted 3D model file provided by an attacker.\nAs the parsing engine reaches the ParseBoneTrafoKeys_3DGS_MDL7 routine, the manipulated transmatrix_count argument forces the application to copy or write transformation key data beyond the allocated buffer limits.\nThis memory corruption can overwrite adjacent heap or stack metadata, depending on the memory layout, leading to application instability or precise control flow hijacking if shellcode or ROP chains are deployed by the attacker.\nThe affected product version is Open Asset Import Library Assimp commit 17c12da, and the vulnerable file path is code/AssetLib/MDL/MDLLoader.cpp.\nThe vulnerability is exposed remotely in scenarios where applications process external, untrusted 3D assets over a network without prior sanitization.\nNo authentication or special privileges are necessary to exploit this vulnerability beyond delivering the malformed file to the target application."
}