The vulnerability CVE-2026-19968 affects Open Asset Import Library Assimp, specifically the function Assimp::MDLImporter::ReadFaces_3DGS_MDL7 in the code/AssetLib/LWO/LWOLoader.h file. It is a heap-based buffer overflow that can be triggered remotely without privileges or user interaction. The issue arises from improper handling of input data in the 3DGS MDL7 Model Parser, potentially allowing attackers to corrupt memory. A patch identified by commit ee77bb09a42a49843ac85ef64c14d2328b251df1 is available to fix this vulnerability. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, no confidentiality or integrity impact, and low availability impact.

Successful exploitation of this vulnerability may lead to heap-based memory corruption, which could cause application crashes or potentially enable further attacks depending on the context of use. The CVSS score of 5.3 reflects a medium severity with limited impact on confidentiality and integrity but some impact on availability. No confirmed active exploitation in the wild has been reported.

A patch identified by commit ee77bb09a42a49843ac85ef64c14d2328b251df1 is available and should be applied to resolve this issue. Since the vendor advisory or patch links are not explicitly provided, users should consult the official Open Asset Import Library repository or vendor channels to obtain and apply the patch. No alternative mitigations or workarounds are specified.