CVE-2026-19969 describes a buffer overflow vulnerability in the Open Asset Import Library (Assimp) version identified by commit 17c12da. The vulnerable code is located in the function Assimp::MDLImporter::GenerateOutputMeshes_3DGS_MDL7 in the file code/AssetLib/MDL/MDLLoader.cpp, which is part of the 3DGS MDL7 Model Output Mesh Generator component. The vulnerability allows remote exploitation, and public exploit code has been disclosed. The project was notified early but has not yet issued a fix or official response.

The buffer overflow can be triggered remotely, potentially leading to memory corruption. The CVSS 4.0 score is 5.3 (medium severity), indicating limited impact with no privileges required and user interaction needed. The vulnerability could lead to partial loss of integrity and availability but does not indicate complete system compromise. No known exploits are reported in the wild beyond public disclosure.

No official fix or patch is currently available, and the vendor has not responded to the issue report. Users should monitor the vendor's advisories for updates. Until a patch is released, cautious use or avoidance of the affected function or component is recommended. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.