assimp security update (CVE-2026-82591)
Description
A heap-based buffer overflow vulnerability exists in the Open Asset Import Library (Assimp) versions up to 6.0.2 in the function MD5Importer::MakeDataUnique. The flaw arises from improper manipulation of the argument iNewIndex. Exploitation requires local access. A patch has been released to address this issue.
CVSS v3.1
Score 5.3medium
Affected software
pkg:rpm/openEuler/assimp&distro=openEuler-24.03-LTS-SP1Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-82591 affects Assimp, a library used for loading and processing geometric scenes. The vulnerability is a heap-based buffer overflow in the MD5Importer::MakeDataUnique function within the MD5Loader.cpp source file. The issue is triggered by manipulation of the iNewIndex argument. This vulnerability is exploitable only from a local environment. The patch identified by commit bf9dabb617c46e5133dac65cca6bff177917afcb fixes the issue. The affected versions include all releases up to 6.0.2 and versions prior to 5.3.1-22.oe2403sp1.
Potential Impact
Successful exploitation can lead to a heap-based buffer overflow, potentially causing denial of service or limited code execution impact. The CVSS 3.1 base score is 5.3 (medium severity), reflecting local attack vector, low complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.
Mitigation Recommendations
A patch is available and should be applied to affected versions to remediate this vulnerability. The patch is identified by commit bf9dabb617c46e5133dac65cca6bff177917afcb. No additional mitigation is indicated as the vulnerability requires local access and is fixed by the official update.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-4pff-rvgp-gggv
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-82591"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a95a101acd9273b4947e999
Added to database: 08/31/2026, 15:42:57 UTC
Last enriched: 09/25/2026, 04:58:45 UTC
Last updated: 10/15/2026, 06:48:19 UTC
Views: 67
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.