PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10229 Assimp CVE debrief

A heap-based buffer overflow vulnerability exists in the Open Asset Import Library (Assimp) through version 6.0.4, specifically within the Half-Life 1 MDL Loader component. The flaw resides in the `HL1MDLLoader::read_meshes` function in `HL1MDLLoader.cpp`. The vulnerability requires local access and low privileges to exploit, with no user interaction needed. A proof-of-concept has been publicly disclosed, increasing the risk of attempted exploitation. The Assimp project has acknowledged the issue as a bug. The CVSS 4.0 vector indicates local attack vector, low attack complexity, and low impacts to confidentiality, integrity, and availability.

Vendor
Assimp
Product
Open Asset Import Library
CVSS
LOW 1.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-01
Original CVE updated
2026-07-22
Advisory published
2026-06-01
Advisory updated
2026-07-22

Who should care

Organizations using Assimp to process untrusted Half-Life 1 MDL files in local applications; developers integrating Assimp into 3D asset pipelines; security teams monitoring for local privilege escalation vectors in graphics processing libraries

Technical summary

The vulnerability is a heap-based buffer overflow in `HL1MDLLoader::read_meshes` within `HL1MDLLoader.cpp` of the Assimp library (≤6.0.4). The Half-Life 1 MDL Loader component fails to properly validate buffer boundaries when processing mesh data from MDL files. Exploitation requires local execution with low privileges and no user interaction. Public proof-of-concept availability increases exploitability risk despite the local attack vector constraint. The Assimp project has classified the reported issue as a bug.

Defensive priority

low

Recommended defensive actions

  • Upgrade Assimp to a version newer than 6.0.4 when a patched release becomes available; monitor the Assimp GitHub repository for security updates
  • Restrict execution of untrusted Half-Life 1 MDL files to isolated, non-production environments
  • Apply principle of least privilege for local user accounts that process 3D model files through Assimp
  • Monitor for anomalous crashes in applications using Assimp's HL1 MDL loader, which may indicate exploitation attempts
  • Review and validate MDL file inputs before processing through Assimp in security-sensitive applications

Evidence notes

The vulnerability description is sourced from the NVD record with CNA attribution to Vuldb. The affected function `HL1MDLLoader::read_meshes` and file `HL1MDLLoader.cpp` are explicitly named. CVSS 4.0 score of 1.9 with LOW severity is derived from the vector: AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/E:P. CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-122 (Heap-based Buffer Overflow) are identified as weakness classifications. The vendor attribution to Assimp is based on GitHub repository references and issue #6614.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-10229 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-10229

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-10229 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-10229

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.