CVE-2026-19999 is a medium severity buffer overflow vulnerability in Open Asset Import Library Assimp version 17c12da. It affects the function Assimp::MDLImporter::ParseBoneTrafoKeys_3DGS_MDL7 in the file MDLLoader.cpp, where manipulation of the transmatrix_count and pcBoneTransforms arguments leads to a buffer overflow condition. The vulnerability can be triggered remotely without privileges or user interaction. A patch identified by commit 50d767984e78d51b53e2020fdf0967fd624bc377 is recommended to fix the issue. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, partial user interaction, and low impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could lead to a buffer overflow, potentially allowing an attacker to cause a denial of service or execute arbitrary code remotely. The CVSS score of 5.3 reflects a medium impact with partial loss of confidentiality, integrity, and availability. No active exploitation in the wild has been reported so far.

A patch identified by commit 50d767984e78d51b53e2020fdf0967fd624bc377 is available and should be applied to remediate this vulnerability. Applying this official fix will prevent exploitation of the buffer overflow condition. No additional mitigation steps are indicated by the vendor advisory.