{"id":"CVE-2026-129480","kind":"vulnerability","aliases":["CVE-2026-129480"],"related":[],"title":"Assimp: crafted MD2 model file reads past heap buffer","description":"Assimp through 6.0.6 contains a heap out-of-bounds read vulnerability in MD2Importer::InternReadFile that allows attackers to read past the file buffer via an unvalidated stored frameSize header field. Attackers can supply a crafted .md2 file loaded with a non-zero keyframe selected to crash the application or leak adjacent heap memory into the imported mesh.","summary":"Assimp, a library that loads 3D model files, reads past the end of a heap buffer when parsing a crafted .md2 file with a bad frame size header. An attacker who supplies such a file can crash the application or leak adjacent heap memory into the imported mesh.","severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["3d-models","assimp","c++","package"],"not_affected_if":["no-md2-import","trusted-input-only"],"how_to_check":"- Check whether your project depends on Assimp, for example `assimp` in your build files or a bundled `libassimp` package.\n- Look for code that loads user-supplied `.md2` files through Assimp.\n- Confirm the installed Assimp version with the tool your build uses; the sources do not give a check command.","fix":null,"status":"open","published_at":"2026-11-15T14:17:27+00:00","first_seen_at":"2026-11-15T14:36:16+00:00","triaged_at":"2026-11-15T14:37:45+00:00","updated_at":"2026-11-15T14:37:45+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-15T14:37:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Assimp: crafted MD2 model file reads past heap buffer","impact":"medium","summary":"Assimp, a library that loads 3D model files, reads past the end of a heap buffer when parsing a crafted .md2 file with a bad frame size header. An attacker who supplies such a file can crash the application or leak adjacent heap memory into the imported mesh.","audience":"developers","category":"package","nicknames":[],"who_cares":["assimp","3d-models","c++"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"crash or leak of nearby heap memory into output","analyst_note":"Confirm the fixed version and affected package registry entry for Assimp; the sources only give 'through 6.0.6' and a vulncheck advisory.","how_to_check":"- Check whether your project depends on Assimp, for example `assimp` in your build files or a bundled `libassimp` package.\n- Look for code that loads user-supplied `.md2` files through Assimp.\n- Confirm the installed Assimp version with the tool your build uses; the sources do not give a check command.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-md2-import","trusted-input-only"],"who_is_affected":"Applications that use Assimp to import MD2 model files, especially those that accept model files from untrusted users. Programs that only load models you create yourself, or that never import MD2 files, are less exposed. The sources do not name a fixed version.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000741,"input_tokens":4614,"output_tokens":559,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-129480':12A,15A '-2026':11A,14A '3d':17B,27B '3d-models':16B '6.0.6':72C 'adjac':63B,122C 'allow':86C 'applic':60B,119C 'assimp':1A,19B,22B,70C 'attack':51B,87C,101C 'bad':46B 'bound':79C 'buffer':9A,37B,93C 'c':20B 'contain':73C 'craft':2A,41B,105C 'crash':58B,117C 'cve':10A,13A 'end':33B 'field':100C 'file':5A,29B,43B,56B,92C,107C 'frame':47B 'frames':98C 'header':49B,99C 'heap':8A,36B,64B,75C,123C 'import':68B,127C 'internreadfil':84C 'keyfram':114C 'leak':62B,121C 'librari':24B 'load':26B,108C 'md2':3A,42B,106C 'md2importer':83C 'memori':65B,124C 'mesh':69B,128C 'model':4A,18B,28B 'non':112C 'non-zero':111C 'out-of-bound':76C 'packag':21B 'pars':39B 'past':7A,31B,90C 'read':6A,30B,80C,89C 'select':115C 'size':48B 'store':97C 'suppli':53B,103C 'unvalid':96C 'via':94C 'vulner':81C 'zero':113C","nicknames":[],"mitigations":[],"who_affected":"Applications that use Assimp to import MD2 model files, especially those that accept model files from untrusted users. Programs that only load models you create yourself, or that never import MD2 files, are less exposed. The sources do not name a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["3dmodels","assimp","c","medium","package"],"campaign_type":null,"search_a":"'-129480':12A,15A '-2026':11A,14A 'assimp':1A 'buffer':9A 'craft':2A 'cve':10A,13A 'file':5A 'heap':8A 'md2':3A 'model':4A 'past':7A 'read':6A","search_b":"'3d':17B,27B '3d-models':16B 'adjac':63B 'applic':60B 'assimp':19B,22B 'attack':51B 'bad':46B 'buffer':37B 'c':20B 'craft':41B 'crash':58B 'end':33B 'file':29B,43B,56B 'frame':47B 'header':49B 'heap':36B,64B 'import':68B 'leak':62B 'librari':24B 'load':26B 'md2':42B 'memori':65B 'mesh':69B 'model':18B,28B 'packag':21B 'pars':39B 'past':31B 'read':30B 'size':48B 'suppli':53B","search_c":"'6.0.6':72C 'adjac':122C 'allow':86C 'applic':119C 'assimp':70C 'attack':87C,101C 'bound':79C 'buffer':93C 'contain':73C 'craft':105C 'crash':117C 'field':100C 'file':92C,107C 'frames':98C 'header':99C 'heap':75C,123C 'import':127C 'internreadfil':84C 'keyfram':114C 'leak':121C 'load':108C 'md2':106C 'md2importer':83C 'memori':124C 'mesh':128C 'non':112C 'non-zero':111C 'out-of-bound':76C 'past':90C 'read':80C,89C 'select':115C 'store':97C 'suppli':103C 'unvalid':96C 'via':94C 'vulner':81C 'zero':113C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T14:17:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129480","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129480","severity":null,"published_at":"2026-11-15T14:17:27+00:00","modified_at":"2026-11-15T14:17:27+00:00","first_seen_at":"2026-11-15T14:36:16+00:00","fetched_at":"2026-11-15T14:36:16+00:00","note":null}],"documents":[{"id":163819,"url":"https://www.vulncheck.com/advisories/assimp-through-6.0.6-heap-out-of-bounds-read-via-md2-importer-framesize","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}