{"id":"CVE-2026-117608","kind":"vulnerability","aliases":["CVE-2026-117608"],"related":[],"title":"Assimp: crafted MD2 file overflows header check, leaks or crashes heap","description":"Assimp through 6.0.5 contains an integer overflow vulnerability in MD2Importer::ValidateHeader() that allows attackers to bypass frame table bounds checks using crafted header fields. Attackers can supply a malicious .md2 file whose numFrames and numVertices values wrap the 32-bit size check, causing heap out-of-bounds reads that crash applications or expose adjacent heap memory.","summary":"Assimp through 6.0.5 has an integer overflow in its MD2 importer header validation. A crafted .md2 model file can bypass frame table bounds checks, causing out-of-bounds heap reads that crash the application or expose adjacent heap memory.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["3d-assets","assimp","c++","package"],"not_affected_if":["md2-import-unused","no-untrusted-md2-input"],"how_to_check":"- Check the Assimp version your application links against, e.g. `pkg-config --modversion assimp` or the version in your package manifest; anything through `6.0.5` is in scope.\n- Search your dependencies for Assimp, e.g. `grep -ri assimp` in build files and lockfiles, to find where it is bundled.","fix":null,"status":"open","published_at":"2026-10-28T03:17:12+00:00","first_seen_at":"2026-10-28T03:31:02+00:00","triaged_at":"2026-10-28T03:32:36+00:00","updated_at":"2026-10-28T03:32:36+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T03:32:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Assimp: crafted MD2 file overflows header check, leaks or crashes heap","impact":"medium","summary":"Assimp through 6.0.5 has an integer overflow in its MD2 importer header validation. A crafted .md2 model file can bypass frame table bounds checks, causing out-of-bounds heap reads that crash the application or expose adjacent heap memory.","category":"package","nicknames":[],"who_cares":["assimp","3d-assets","c++"],"confidence":0.6,"needs_auth":"no","worst_case":"Heap memory is read out of bounds, leaking data or crashing the host app","analyst_note":"Find the upstream fix commit or release for Assimp after 6.0.5 and confirm the patched version; the sources give no fix version.","how_to_check":"- Check the Assimp version your application links against, e.g. `pkg-config --modversion assimp` or the version in your package manifest; anything through `6.0.5` is in scope.\n- Search your dependencies for Assimp, e.g. `grep -ri assimp` in build files and lockfiles, to find where it is bundled.","needs_analyst":true,"not_affected_if":["no-untrusted-md2-input","md2-import-unused"],"who_is_affected":"Applications that use Assimp to load untrusted .md2 model files, such as user uploads or third-party assets, are exposed. Applications that only load models you ship yourself, or that never import MD2 files, have a much smaller exposure and can skip it until a fixed version is available.","user_interaction":"unknown","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.00062,"input_tokens":3362,"output_tokens":567,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-117608':14A,17A '-2026':13A,16A '32':102C '3d':19B '3d-assets':18B '6.0.5':26B,66C 'adjac':61B,118C 'allow':76C 'applic':58B,115C 'asset':20B 'assimp':1A,21B,24B,64C 'attack':77C,88C 'bit':103C 'bound':46B,52B,82C,111C 'bypass':43B,79C 'c':22B 'caus':48B,106C 'check':7A,47B,83C,105C 'contain':67C 'craft':2A,38B,85C 'crash':10A,56B,114C 'cve':12A,15A 'expos':60B,117C 'field':87C 'file':4A,41B,94C 'frame':44B,80C 'header':6A,35B,86C 'heap':11A,53B,62B,107C,119C 'import':34B 'integ':29B,69C 'leak':8A 'malici':92C 'md2':3A,33B,39B,93C 'md2importer':73C 'memori':63B,120C 'model':40B 'numfram':96C 'numvertic':98C 'out-of-bound':49B,108C 'overflow':5A,30B,70C 'packag':23B 'read':54B,112C 'size':104C 'suppli':90C 'tabl':45B,81C 'use':84C 'valid':36B 'validatehead':74C 'valu':99C 'vulner':71C 'whose':95C 'wrap':100C","nicknames":[],"mitigations":[],"who_affected":"Applications that use Assimp to load untrusted .md2 model files, such as user uploads or third-party assets, are exposed. Applications that only load models you ship yourself, or that never import MD2 files, have a much smaller exposure and can skip it until a fixed version is available.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T03:17:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117608","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117608","severity":null,"published_at":"2026-10-28T03:17:12+00:00","modified_at":"2026-10-28T03:17:12+00:00","first_seen_at":"2026-10-28T03:31:02+00:00","fetched_at":"2026-10-28T03:31:02+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}