CVE-2026-129479 · Package
NO FIX YET
Assimp, a library for loading 3D model files, has an integer overflow in its Ogre binary mesh reader. A crafted .mesh file with a large index count wraps a 32-bit buffer size and causes a segmentation fault during scene teardown, crashing the application.
first public Nov 15, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that embed Assimp through version 6.0.6 and load Ogre binary .mesh files, especially from untrusted sources such as user uploads or downloads. The sources describe a crash (denial of service), not code execution. Applications that never parse Ogre mesh files can likely skip it.
Not affected if no-ogre-mesh-loading, trusted-input-only
Who cares 3d-models, assimp, c++
assimp..mesh files from untrusted sources.No fix yet, per the sources.
Assimp through 6.0.6 contains an integer overflow vulnerability in OgreBinarySerializer::ReadSubMesh that allows attackers to crash applications by supplying crafted Ogre binary .mesh files. Attackers can set a large index count so the 32-bit buffer size wraps, causing a segmentation fault in aiMesh::~aiMesh() during scene teardown.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.