CVE-2026-117608 Assimp through 6.0.5 Heap Out-of-Bounds Read via MD2 Importer Integer Overflow

Medium 6.9 Published 28 Oct 2026 Updated 28 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-117608?

CVE-2026-117608 is a medium-severity vulnerability in assimp, published on 28 Oct 2026.

Official description

Assimp through 6.0.5 contains an integer overflow vulnerability in MD2Importer::ValidateHeader() that allows attackers to bypass frame table bounds checks using crafted header fields. Attackers can supply a malicious .md2 file whose numFrames and numVertices values wrap the 32-bit size check, causing heap out-of-bounds reads that crash applications or expose adjacent heap memory.

Weakness: CWE-190

Which versions are affected by CVE-2026-117608?

How do I fix CVE-2026-117608?

No fix has been published for CVE-2026-117608 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-117608 being exploited?

There is no known exploitation of CVE-2026-117608 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2026-117608, GHSA-jr35-9ffc-pmf8, UBUNTU-CVE-2026-117608.