CVE-2026-10233: Assimp Half-Life 1 MDL Loader HL1MDLLoader.cpp read_sequence_infos out-of-bounds
A security vulnerability has been detected in Assimp up to 6.0.4. Affected by this issue is the function HL1MDLLoader::readsequenceinfos of the file HL1MDLLoader.cpp of the component Half-Life 1 MDL Loader. The manipulation of the argument aiString leads to out-of-bounds read. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The project tagged the reported issue as bug.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Assimp Half-Life 1 MDL Loader (HL1MDLLoader)from your environment.Uninstall or stop using the Assimp Half-Life 1 MDL Loader component (HL1MDLLoader) or avoid processing HL1 MDL files on affected systems if the component is not required.
- Compensating control
Prevent exposure to untrusted HL1 MDL files and restrict local access: only allow trusted local users to run software that uses HL1MDLLoader, and process any untrusted HL1 MDL files inside isolated environments (VMs/containers/sandbox) to mitigate exploitation since the attack requires local access.
- Operational
Monitor the Assimp project for an official fix or patched release for the HL1MDLLoader read_sequence_infos vulnerability and apply the update as soon as it becomes available; track the reported issue tagged as a bug.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10233?
CVE-2026-10233 has a low severity rating of 3.3.
What type of vulnerability is CVE-2026-10233?
CVE-2026-10233 is categorized as a buffer overflow vulnerability.
How does CVE-2026-10233 affect the Assimp software?
CVE-2026-10233 affects the HL1MDLLoader::read_sequence_infos function, leading to out-of-bounds read.
Is there a fix available for CVE-2026-10233?
To resolve CVE-2026-10233, users should upgrade to a patched version of Assimp beyond 6.0.4.
What components are impacted by CVE-2026-10233?
CVE-2026-10233 specifically impacts the Half-Life 1 MDL Loader within the Assimp software.