CVE-2026-19967: Open Asset Import Library Assimp File Compression.cpp decompressBlock heap-based overflow
A security flaw has been discovered in Open Asset Import Library Assimp 17c12da. Impacted is the function Assimp::Compression::decompressBlock of the file code/Common/Compression.cpp of the component File Parser. Performing a manipulation results in heap-based buffer overflow. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19967?
The severity of CVE-2026-19967 is classified as medium with a CVSS score of 6.3.
How does CVE-2026-19967 affect the Open Asset Import Library?
CVE-2026-19967 affects the Assimp library by introducing a heap-based buffer overflow vulnerability in the decompressBlock function.
What are the potential impacts of exploiting CVE-2026-19967?
Exploiting CVE-2026-19967 may lead to arbitrary code execution or crashes due to the buffer overflow.
How do I fix CVE-2026-19967?
To fix CVE-2026-19967, update the Open Asset Import Library to the latest version that addresses this vulnerability.
Is my application at risk if it uses an affected version of Assimp due to CVE-2026-19967?
Yes, applications using an affected version of Assimp are at risk and should be updated to mitigate CVE-2026-19967.