CVE-2026-108573 is an out-of-bounds read vulnerability in the Open Asset Import Library (Assimp) affecting versions 6.0.0 through 6.0.5. The flaw exists in the IOStreamBuffer::getNextBlock function within the PLY File Handler component. This vulnerability can be triggered remotely by manipulating input, potentially leading to reading memory outside the intended bounds. The vendor has not responded to disclosure requests, and no patch or fix information is currently available.
A heap-based buffer overflow vulnerability exists in the Open Asset Import Library (Assimp) versions 6.0.0, 6.0.1, and 6.0.2. The flaw is in the MD5Importer::MakeDataUnique function within the MD5Loader.cpp file, where improper handling of the iNewIndex argument can lead to memory corruption. Exploitation requires local access. A patch identified by commit bf9dabb617c46e5133dac65cca6bff177917afcb is recommended to remediate the issue.
A buffer overflow vulnerability exists in the Open Asset Import Library Assimp, specifically in the function Assimp::MDLImporter::ParseBoneTrafoKeys_3DGS_MDL7 within the 3DGS MDL7 Bone Transformation Key Parser component. The flaw arises from improper handling of the arguments transmatrix_count and pcBoneTransforms, which can be manipulated remotely to trigger the overflow. A patch identified by commit 50d767984e78d51b53e2020fdf0967fd624bc377 is available to address this issue. The vulnerability has a medium severity rating with a CVSS score of 5.3. Public disclosure of the exploit exists, but no known active exploitation in the wild has been reported.
A buffer overflow vulnerability exists in the Open Asset Import Library (Assimp) in the function Assimp::MDLImporter::GenerateOutputMeshes_3DGS_MDL7. The vulnerability arises because the code copies an input buffer to an output buffer without verifying that the input size is less than the output buffer size. This flaw can be remotely exploited, potentially impacting the integrity and availability of the affected system. The vulnerability has been publicly disclosed, but no patch or official fix has been announced yet.
A vulnerability was detected in Open Asset Import Library Assimp 17c12da. This affects the function Assimp::MDLImporter::AddBonesToNodeGraph_3DGS_MDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component Node Parser. The manipulation of the argument bones_num results in heap-based buffer overflow. The attack can be executed remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
A heap-based buffer overflow vulnerability exists in the Open Asset Import Library (Assimp) within the function Assimp::MDLImporter::ReadFaces_3DGS_MDL7 in the 3DGS MDL7 Model Parser component. This flaw can be triggered remotely and may lead to memory corruption. A patch identified by commit ee77bb09a42a49843ac85ef64c14d2328b251df1 has been made available to address the issue. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. Exploit code is publicly available, but no known exploitation in the wild has been reported.
A security flaw has been discovered in Open Asset Import Library Assimp 17c12da. Impacted is the function Assimp::Compression::decompressBlock of the file code/Common/Compression.cpp of the component File Parser. Performing a manipulation results in heap-based buffer overflow. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
A heap-based buffer overflow vulnerability exists in the Open Asset Import Library (Assimp) up to version 6.0.5. The flaw is located in the function Assimp::CSMImporter::InternReadFile within the CSM File Handler component. Exploitation requires local access and can lead to memory corruption. A patch has been created to address this issue.
A vulnerability was determined in Open Asset Import Library Assimp up to 6.0.4. Affected is the function Assimp::Exporter::ExportToBlob of the file code/AssetLib/Ply/PlyLoader.cpp of the component PLY Model Handler. This manipulation causes double free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report.
A security vulnerability has been detected in Open Asset Import Library Assimp up to 5.4.3. Affected by this vulnerability is the function Assimp::SceneCombiner::Copy of the file code/Common/SceneCombiner.cpp of the component Model File Handler. Such manipulation of the argument width/height leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. This and similar defects are tracked and handled via issue #6128.
A security vulnerability has been detected in Open Asset Import Library Assimp up to 6.0.2. Affected by this vulnerability is the function Assimp::LWOImporter::FindUVChannels of the file /src/assimp/code/AssetLib/LWO/LWOMaterial.cpp. Such manipulation leads to use after free. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. This and similar defects are tracked and handled via issue #6128.
A weakness has been identified in Open Asset Import Library Assimp 6.0.2. This affects the function Q3DImporter::InternReadFile of the file assimp/code/AssetLib/Q3D/Q3DLoader.cpp. Executing a manipulation can lead to heap-based buffer overflow. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks.
A vulnerability was identified in Open Asset Import Library Assimp 6.0.2. Affected by this vulnerability is the function ODDLParser::getNextSeparator in the library assimp/contrib/openddlparser/include/openddlparser/OpenDDLParserUtils.h. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit is publicly available and might be used.
A vulnerability was determined in Open Asset Import Library Assimp 6.0.2. Affected is the function Q3DImporter::InternReadFile of the file assimp/code/AssetLib/Q3D/Q3DLoader.cpp. This manipulation causes allocation of resources. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized.
A vulnerability classified as critical was found in Open Asset Import Library Assimp up to 5.4.3. Affected by this vulnerability is the function read_meshes in the library assimp/code/AssetLib/MDL/HalfLife/HL1MDLLoader.cpp. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
A vulnerability classified as critical has been found in Open Asset Import Library Assimp up to 5.4.3. Affected is the function Assimp::BVHLoader::ReadNodeChannels in the library assimp/code/AssetLib/BVH/BVHLoader.cpp. The manipulation of the argument pNode leads to use after free. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
A vulnerability classified as problematic has been found in Open Asset Import Library Assimp 5.4.3. This affects the function MDLImporter::ParseSkinLump_3DGS_MDL7 of the file assimp/code/AssetLib/MDL/MDLMaterialLoader.cpp. The manipulation leads to out-of-bounds read. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been rated as problematic. Affected by this issue is the function SkipSpaces in the library assimp/include/assimp/ParsingUtils.h. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been declared as problematic. Affected by this vulnerability is the function HL1MDLLoader::validate_header of the file assimp/code/AssetLib/MDL/HalfLife/HL1MDLLoader.cpp. The manipulation leads to out-of-bounds read. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as problematic. Affected is the function LWOImporter::CountVertsAndFacesLWO2 of the file assimp/code/AssetLib/LWO/LWOLoader.cpp. The manipulation leads to out-of-bounds read. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.