Integer overflow in Assimp
CVE-2026-117608
Assimp through 6.0.5 contains an integer overflow vulnerability in MD2Importer::ValidateHeader() that allows attackers to bypass frame table bounds checks using crafted header fields. Attackers can supply a malicious .md2 file whose numFrames and numVertices values wrap the 32-bit size check, causing heap out-of-bounds reads that crash applications or expose adjacent heap memory.
Vulnerability class: Integer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H.
EPSS exploit prediction
EPSS: 0.001 (3.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 3rd percentile — 3.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
The 30-day trend appears once there are two daily scores.
Affected products
Weakness classification (CWE)
References
- github.com/assimp/assimp/issues/6929 (issue-tracking)
- github.com/assimp/assimp/pull/6963 (issue-tracking, patch)
- github.com/assimp/assimp/commit/7dbc85d9218fae017d4fad70269e7569f7b0c870 (patch)
- github.com/assimp/assimp/blob/v6.0.5/code/AssetLib/MD2/MD2Loader.cpp (technical-description)
- github.com/assimp/assimp (product)
- www.vulncheck.com/advisories/assimp-through-6.0.5-heap-out-of-bounds-read-via-m… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-117608?
- CVE-2026-117608 is a medium-severity vulnerability in Assimp, classified under Integer Overflow or Wraparound. CVSS score: 6.1/10. Published 2026-10-28.
- How severe is CVE-2026-117608?
- Medium severity. CVSS v3 base score is 6.1 out of 10.