CVE-2026-19967— Open Asset Import Library Assimp File Compression.cpp decompressBlock heap-based overflow
Possible ATT&CK Techniques 2AI
T1203 · Exploitation for Client Execution T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-19967
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Open Asset Import Library Assimp File Compression.cpp decompressBlock heap-based overflow
Source: CVE Program / CVE List V5
Vulnerability Description
A security flaw has been discovered in Open Asset Import Library Assimp 17c12da. Impacted is the function Assimp::Compression::decompressBlock of the file code/Common/Compression.cpp of the component File Parser. Performing a manipulation results in heap-based buffer overflow. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
堆缓冲区溢出
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Open Asset Import Library | Assimp | 17c12da | cpe:2.3:a:assimp:assimp:*:*:*:*:*:*:*:* |
II. Public POCs for CVE-2026-19967
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-19967
请登录查看更多情报信息。
News Coverage for CVE-2026-19967 (1)
Other References for CVE-2026-19967 (1)
Same Patch Batch · Open Asset Import Library · 2026-08-17 · 4 CVEs total
| CVE-2026-19970 | 6.3 MEDIUM | Open Asset Import Library Assimp Node MDLLoader.cpp AddBonesToNodeGraph_3DGS_MDL7 heap-bas |
| CVE-2026-19969 | 5.4 MEDIUM | Open Asset Import Library Assimp 3DGS MDL7 Model Output Mesh Generator MDLLoader.cpp Gener |
| CVE-2026-19968 | 4.3 MEDIUM | Open Asset Import Library Assimp 3DGS MDL7 Model LWOLoader.h ReadFaces_3DGS_MDL7 heap-base |
IV. Related Vulnerabilities
Same product: Assimp
- CVE-2026-19970
Open Asset Import Library Assimp Node MDLLoader.cpp AddBones - CVE-2026-19969
Open Asset Import Library Assimp 3DGS MDL7 Model Output Mesh - CVE-2026-19968
Open Asset Import Library Assimp 3DGS MDL7 Model LWOLoader.h - CVE-2026-14610
Open Asset Import Library Assimp CSM File CSMLoader.cpp Inte - CVE-2026-14604
Open Asset Import Library Assimp PLY Model PlyLoader.cpp Exp
Same vendor: Open Asset Import Library
- CVE-2026-19970
Open Asset Import Library Assimp Node MDLLoader.cpp AddBones - CVE-2026-19969
Open Asset Import Library Assimp 3DGS MDL7 Model Output Mesh - CVE-2026-19968
Open Asset Import Library Assimp 3DGS MDL7 Model LWOLoader.h - CVE-2026-14610
Open Asset Import Library Assimp CSM File CSMLoader.cpp Inte - CVE-2026-14604
Open Asset Import Library Assimp PLY Model PlyLoader.cpp Exp
Same weakness: CWE-122
- CVE-2026-19970
Open Asset Import Library Assimp Node MDLLoader.cpp AddBones - CVE-2026-19968
Open Asset Import Library Assimp 3DGS MDL7 Model LWOLoader.h - CVE-2026-72970
Microsoft Edge (Chromium-based) Remote Code Execution Vulner - CVE-2026-19385
PostgreSQL pg_dump heap buffer overflow executes arbitrary c - CVE-2026-14676
PostgreSQL pg_stat_statements heap buffer overflow executes
V. Comments for CVE-2026-19967
No comments yet