CVE-2026-19999 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-19999LOW

Open Asset Import Library Assimp 3DGS MDL7 Bone Transformation Key MDLLoader.cpp ParseBoneTrafoKeys_3DGS_MDL7 buffer overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   P   L   L   L    2.1   .0027   19.8     —

AFFECTED
  Product  Versions   Fixed
  Assimp   17c12da –  —

TIMELINE
  Aug 16  EXPLOIT PUBLISHED — CVE-2026-19999 (Open Asset Import Library Assimp Assimp). Public exploit reference added.
  Aug 16  Reserved by VulDB
  Aug 17  Published (CNA: VulDB)

CWE-120, CWE-119 · CNA: VulDB · CVSS v4.0 · 8 references · NVD status: Received

Description

A security vulnerability has been detected in Open Asset Import Library Assimp Assimp 17c12da. The affected element is the function Assimp::MDLImporter::ParseBoneTrafoKeys_3DGS_MDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component 3DGS MDL7 Bone Transformation Key Parser. The manipulation of the argument transmatrix_count/pcBoneTransforms leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is 50d767984e78d51b53e2020fdf0967fd624bc377. It is recommended to apply a patch to fix this issue.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
August 16, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-19999 (Open Asset Import Library Assimp Assimp). Public exploit reference added.
August 16, 2026	Reserved	Reserved by VulDB
August 17, 2026	Published	Published (CNA: VulDB)

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Open Asset Import Library Assimp	Assimp	—	17c12da	—

Weaknesses

CWE-120 · CWE-119

References (8)

https://github.com/assimp/assimp/commit/50d767984e78d51b53e2020fdf0967fd624bc377 [patch]
https://github.com/assimp/assimp/issues/6633 [issue-tracking]
https://github.com/assimp/assimp/pull/6759 [issue-tracking, patch]
https://github.com/user-attachments/files/27429337/poc.zip [exploit]
https://vuldb.com/cve/CVE-2026-19999 [third-party-advisory]
https://vuldb.com/submit/873132 [third-party-advisory]
https://vuldb.com/vuln/391200 [vdb-entry, technical-description]
https://vuldb.com/vuln/391200/cti [signature, permissions-required]

Authoritative record: CVE-2026-19999 at cve.org

Vendors: open asset import library assimp

Weaknesses: CWE-120 · CWE-119

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-19999 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.