CVE-2026-129478 · Package
NO FIX YET
Assimp, a 3D model import library, mishandles a data offset in its glTF URI parser because it is stored in a signed char. A crafted glTF file can crash an application or leak adjacent heap memory.
first public Nov 15, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that load untrusted glTF files through Assimp are exposed, since the crafted file is the trigger. Systems that only load trusted model files, or do not use Assimp's glTF importer, have less exposure. The sources do not name a fixed version.
Not affected if trusted-input-only
Who cares 3d-models, assimp, gltf
assimp in build files or package manifests)No fix yet, per the sources.
Assimp through 6.0.6 contains a heap out-of-bounds read vulnerability in glTFCommon::Util::ParseDataURI caused by storing the data offset in a signed char. Attackers can supply a crafted glTF file with a raw data URI whose segment starts beyond byte 127 to crash applications or leak adjacent heap memory.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.