CVE-2026-19967 is a heap-based buffer overflow vulnerability in the Open Asset Import Library (Assimp) version 17c12da, specifically in the Assimp::Compression::decompressBlock function within code/Common/Compression.cpp. The flaw arises from improper handling of input data leading to memory corruption on the heap. The vulnerability can be triggered remotely without privileges or user interaction, and exploit code is publicly available. The project has been notified but has not yet provided a patch or official remediation.

Successful exploitation of this vulnerability may allow an attacker to cause a heap-based buffer overflow, potentially leading to application crashes or arbitrary code execution. The vulnerability is remotely exploitable without authentication or user interaction, increasing its risk. However, the CVSS score of 5.3 indicates a medium severity impact, reflecting limited or partial impact on confidentiality, integrity, or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or released a fix, users should monitor official channels for updates. Until a patch is available, avoid processing untrusted or malicious files with the affected Assimp component to reduce risk.