CVE-2026-129480 · Package
NO FIX YET
Assimp, a library that loads 3D model files, reads past the end of a heap buffer when parsing a crafted .md2 file with a bad frame size header. An attacker who supplies such a file can crash the application or leak adjacent heap memory into the imported mesh.
first public Nov 15, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that use Assimp to import MD2 model files, especially those that accept model files from untrusted users. Programs that only load models you create yourself, or that never import MD2 files, are less exposed. The sources do not name a fixed version.
Not affected if no-md2-import, trusted-input-only
Who cares 3d-models, assimp, c++
assimp in your build files or a bundled libassimp package..md2 files through Assimp.No fix yet, per the sources.
Assimp through 6.0.6 contains a heap out-of-bounds read vulnerability in MD2Importer::InternReadFile that allows attackers to read past the file buffer via an unvalidated stored frameSize header field. Attackers can supply a crafted .md2 file loaded with a non-zero keyframe selected to crash the application or leak adjacent heap memory into the imported mesh.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.