{"id":"CVE-2026-129478","kind":"vulnerability","aliases":["CVE-2026-129478"],"related":[],"title":"Assimp: crafted glTF file reads heap memory out of bounds","description":"Assimp through 6.0.6 contains a heap out-of-bounds read vulnerability in glTFCommon::Util::ParseDataURI caused by storing the data offset in a signed char. Attackers can supply a crafted glTF file with a raw data URI whose segment starts beyond byte 127 to crash applications or leak adjacent heap memory.","summary":"Assimp, a 3D model import library, mishandles a data offset in its glTF URI parser because it is stored in a signed char. A crafted glTF file can crash an application or leak adjacent heap memory.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["3d-models","assimp","gltf","package"],"not_affected_if":["trusted-input-only"],"how_to_check":"- Check whether your project depends on Assimp (look for `assimp` in build files or package manifests)\n- Check the Assimp version in use against the fixed version, if the sources give one: unknown","fix":null,"status":"open","published_at":"2026-11-15T14:17:26+00:00","first_seen_at":"2026-11-15T14:36:15+00:00","triaged_at":"2026-11-15T14:37:36+00:00","updated_at":"2026-11-15T14:37:36+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-15T14:37:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Assimp: crafted glTF file reads heap memory out of bounds","impact":"medium","summary":"Assimp, a 3D model import library, mishandles a data offset in its glTF URI parser because it is stored in a signed char. A crafted glTF file can crash an application or leak adjacent heap memory.","audience":"developers","category":"package","nicknames":[],"who_cares":["assimp","3d-models","gltf"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"crashes the app or leaks nearby heap memory contents","analyst_note":"Confirm the fixed Assimp version and whether the glTF importer is enabled by default; check the vulncheck advisory for details.","how_to_check":"- Check whether your project depends on Assimp (look for `assimp` in build files or package manifests)\n- Check the Assimp version in use against the fixed version, if the sources give one: unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["trusted-input-only"],"who_is_affected":"Applications that load untrusted glTF files through Assimp are exposed, since the crafted file is the trigger. Systems that only load trusted model files, or do not use Assimp's glTF importer, have less exposure. The sources do not name a fixed version.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00071,"input_tokens":4605,"output_tokens":498,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-129478':13A,16A '-2026':12A,15A '127':102C '3d':18B,25B '3d-models':17B '6.0.6':61C 'adjac':56B,108C 'applic':53B,105C 'assimp':1A,20B,23B,59C 'attack':85C 'beyond':100C 'bound':10A,68C 'byte':101C 'caus':75C 'char':45B,84C 'contain':62C 'craft':2A,47B,89C 'crash':51B,104C 'cve':11A,14A 'data':31B,79C,95C 'file':4A,49B,91C 'gltf':3A,21B,35B,48B,90C 'gltfcommon':72C 'heap':6A,57B,64C,109C 'import':27B 'leak':55B,107C 'librari':28B 'memori':7A,58B,110C 'mishandl':29B 'model':19B,26B 'offset':32B,80C 'out-of-bound':65C 'packag':22B 'parsedatauri':74C 'parser':37B 'raw':94C 'read':5A,69C 'segment':98C 'sign':44B,83C 'start':99C 'store':41B,77C 'suppli':87C 'uri':36B,96C 'util':73C 'vulner':70C 'whose':97C","nicknames":[],"mitigations":[],"who_affected":"Applications that load untrusted glTF files through Assimp are exposed, since the crafted file is the trigger. Systems that only load trusted model files, or do not use Assimp's glTF importer, have less exposure. The sources do not name a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["3dmodels","assimp","gltf","medium","package"],"campaign_type":null,"search_a":"'-129478':13A,16A '-2026':12A,15A 'assimp':1A 'bound':10A 'craft':2A 'cve':11A,14A 'file':4A 'gltf':3A 'heap':6A 'memori':7A 'read':5A","search_b":"'3d':18B,25B '3d-models':17B 'adjac':56B 'applic':53B 'assimp':20B,23B 'char':45B 'craft':47B 'crash':51B 'data':31B 'file':49B 'gltf':21B,35B,48B 'heap':57B 'import':27B 'leak':55B 'librari':28B 'memori':58B 'mishandl':29B 'model':19B,26B 'offset':32B 'packag':22B 'parser':37B 'sign':44B 'store':41B 'uri':36B","search_c":"'127':102C '6.0.6':61C 'adjac':108C 'applic':105C 'assimp':59C 'attack':85C 'beyond':100C 'bound':68C 'byte':101C 'caus':75C 'char':84C 'contain':62C 'craft':89C 'crash':104C 'data':79C,95C 'file':91C 'gltf':90C 'gltfcommon':72C 'heap':64C,109C 'leak':107C 'memori':110C 'offset':80C 'out-of-bound':65C 'parsedatauri':74C 'raw':94C 'read':69C 'segment':98C 'sign':83C 'start':99C 'store':77C 'suppli':87C 'uri':96C 'util':73C 'vulner':70C 'whose':97C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T14:17:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129478","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129478","severity":null,"published_at":"2026-11-15T14:17:26+00:00","modified_at":"2026-11-15T14:17:26+00:00","first_seen_at":"2026-11-15T14:36:15+00:00","fetched_at":"2026-11-15T14:36:15+00:00","note":null}],"documents":[{"id":163817,"url":"https://www.vulncheck.com/advisories/assimp-through-6.0.6-heap-out-of-bounds-read-via-gltf-parsedatauri","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}