VulnerabilityPublished 4 Aug 2026Updated 11 Nov 2026

Assimp::MD5::MD5MeshParser::MD5MeshParser · Heap-buffer-overflow

Affects assimpSource GCVE Database

Severity

High

Rated High by Threat Radar's AI analysis

Data as of 11 Nov 2026, 15:23 UTC

What to do

Affected software

Product	Affected	Fixed in
OSS-Fuzzassimp`pkg:generic/assimp`Other threats	Affected >=16c50d7b53b5b6536599135004fb003c5e6f88b8 =v6.0.6	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Until a fix is available, avoid processing untrusted MD5 mesh files with Assimp version 6.0.6.

Description

A heap-buffer-overflow vulnerability exists in the Assimp library specifically in the MD5MeshParser component used to parse MD5 mesh files. This issue was reported by OSS-Fuzz and involves a read overflow during parsing operations.

Impact

The heap-buffer-overflow read could lead to memory corruption or application crashes when processing crafted MD5 mesh files. No evidence of exploitation in the wild is reported. The impact is limited to the affected version 6.0.6 of Assimp and may affect applications using this library for MD5 mesh file parsing.

Summary

The vulnerability is a heap-buffer-overflow read detected in the Assimp library's MD5MeshParser constructor, as identified by OSS-Fuzz. The crash occurs during the loading and internal reading of MD5 mesh files, specifically within the functions MD5MeshParser::MD5MeshParser, MD5Importer::LoadMD5MeshFile, and MD5Importer::InternReadFile. The affected version is 6.0.6. No CVSS score or detailed impact metrics are provided.

References

bugs.chromium.org/p/oss-fuzz/issues/detail?id=541854675 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 11 Nov 2026, 15:23 UTC

Technical details

References

Community reviews

Related threats