PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10230 Open Asset Import Library CVE debrief

A heap-based buffer overflow vulnerability exists in the Open Asset Import Library (Assimp) up to version 6.0.4, specifically within the Half-Life 1 MDL Loader component. The flaw resides in the `Assimp::MDL::HalfLife::HL1MDLLoader::read_animations` function of `HL1MDLLoader.cpp`. Successful exploitation requires local access and low privileges, with no user interaction needed. The vulnerability has been publicly disclosed and an exploit is available, though the project maintainers have tagged the reported issue as a bug. The CVSS 4.0 vector indicates local attack vector with low attack complexity, and low impacts to confidentiality, integrity, and availability. No known ransomware campaign use has been identified, and this CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Vendor
Open Asset Import Library
Product
Assimp
CVSS
LOW 1.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-01
Original CVE updated
2026-06-01
Advisory published
2026-06-01
Advisory updated
2026-06-01

Who should care

Organizations and developers using Assimp to process Half-Life 1 MDL files in local workflows, particularly in multi-user environments where untrusted users may supply model files. Game engine developers, 3D asset pipeline maintainers, and security teams monitoring open-source 3D library dependencies should prioritize patching when available.

Technical summary

The vulnerability is a heap-based buffer overflow (CWE-119/CWE-122) in the `read_animations` function of `HL1MDLLoader.cpp` within Assimp's Half-Life 1 MDL Loader. Affected versions are up to and including 6.0.4. The attack requires local access with low privileges and no user interaction. The exploit is publicly available. The CVSS 4.0 vector is AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/E:P, yielding a base score of 1.9 (LOW severity). The vulnerability does not affect system confidentiality, integrity, or availability scope (SC:N/SI:N/SA:N).

Defensive priority

low

Recommended defensive actions

  • Upgrade Assimp to a version newer than 6.0.4 when available, or apply patches from the project maintainers referencing the reported issue.
  • Restrict local access to systems processing untrusted Half-Life 1 MDL files to trusted users only.
  • Monitor the assimp/assimp GitHub repository for security updates and patch releases addressing this vulnerability.
  • Validate and sanitize Half-Life 1 MDL files before processing through Assimp in production environments.
  • Review application logs for anomalous crashes or memory errors in components utilizing Assimp's HL1 MDL loader.

Evidence notes

The vulnerability was reported to VulDB (submission 821190) and assigned CVE-2026-10230. The issue was tracked as GitHub issue #6615 in the assimp/assimp repository. The project tagged the issue as a bug. The CVSS 4.0 score of 1.9 reflects the local attack vector and limited impact scope.

Official resources

public