CVE-2026-19969 Memory corruption in Assimp
A buffer overflow in Assimp's MDL7 mesh generator allows remote attackers to execute arbitrary code or cause denial of service via crafted 3D model files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-19969?
CVE-2026-19969 is a medium-severity memory corruption vulnerability in Open Asset Import Library Assimp, published on 17 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A security vulnerability has been detected in Open Asset Import Library Assimp 17c12da. The impacted element is the function Assimp::MDLImporter::GenerateOutputMeshes_3DGS_MDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component 3DGS MDL7 Model Output Mesh Generator. The manipulation leads to buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Which versions are affected by CVE-2026-19969?
How do I fix CVE-2026-19969?
No fix published yet.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-19969 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-19969 exists.
Sources
Also known as DEBIAN-CVE-2026-19969, GHSA-39wv-72w9-m7wp, OESA-2026-4447, OESA-2026-4448, OESA-2026-4449, UBUNTU-CVE-2026-19969.