CVE-2026-10230: Assimp Half-Life 1 MDL Loader HL1MDLLoader.cpp read_animations heap-based overflow
A vulnerability was identified in Assimp up to 6.0.4. This impacts the function Assimp::MDL::HalfLife::HL1MDLLoader::readanimations of the file HL1MDLLoader.cpp of the component Half-Life 1 MDL Loader. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit is publicly available and might be used. The project tagged the reported issue as bug.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Assimp (Half-Life 1 MDL Loader)from your environment.If Assimp or the Half-Life 1 MDL Loader (HL1MDLLoader) is not required, uninstall or remove the component to eliminate the vulnerable code and avoid loading HL1 MDL files.
- Compensating control
Prevent untrusted local users from supplying or opening HL1 MDL files on hosts that run Assimp. Restrict user accounts and local file drop locations via ACLs, host-based controls, or network restrictions because the attack requires local access.
- Compensating control
Process any untrusted .mdl files only within isolated environments (sandbox, VM, or container) with minimal privileges and no access to sensitive resources or networks to contain potential exploitation.
- Operational
Inventory systems and applications that include or call Assimp/HL1MDLLoader, stop processing untrusted HL1 MDL files until a vendor fix is available, and monitor for signs of exploitation (public exploit code usage).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10230?
The severity of CVE-2026-10230 is classified as medium with a score of 5.3.
How does CVE-2026-10230 affect Assimp?
CVE-2026-10230 affects Assimp up to version 6.0.4 by introducing a heap-based buffer overflow vulnerability in the Half-Life 1 MDL Loader.
What component is vulnerable in CVE-2026-10230?
The vulnerable component in CVE-2026-10230 is the Half-Life 1 MDL Loader, specifically the HL1MDLLoader.cpp file.
How can I mitigate CVE-2026-10230?
To mitigate CVE-2026-10230, users should upgrade to a version of Assimp that is beyond 6.0.4.
What type of attack is possible with CVE-2026-10230?
CVE-2026-10230 allows for local attacks that can exploit the heap-based buffer overflow vulnerability during animation reading.