CVE-2026-82591: Heap-based Buffer Overflow in Open Asset Import Library Assimp

CVE-2026-82591 is a heap-based buffer overflow vulnerability in Assimp up to version 6.0.2. The vulnerability arises from improper manipulation of the iNewIndex argument in the MD5Importer::MakeDataUnique function of the MD5Loader.cpp source file. This can cause a buffer overflow on the heap, potentially leading to memory corruption. The attack vector is local, requiring attacker access to the environment where Assimp is running. A patch exists identified by the commit bf9dabb617c46e5133dac65cca6bff177917afcb, which should be applied to fix the vulnerability.

Successful exploitation of this vulnerability could result in heap memory corruption, which may cause application crashes or potentially allow an attacker with local access to execute arbitrary code or escalate privileges. However, the attack requires local access and no remote exploitation vector is indicated. The CVSS 4.8 (medium) score reflects the limited attack vector and complexity.

A patch identified by commit bf9dabb617c46e5133dac65cca6bff177917afcb is available and applying this patch is the recommended remediation. Since the vulnerability requires local access, restricting local user permissions and access can also reduce risk. Patch status is not explicitly confirmed as 'official-fix' in the vendor advisory, so verify the patch availability and application with the vendor or source repository.