CVE-2026-10233
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In Assimp up to 6.0.4, the HL1MDLLoader::read_sequence_infos function has an out-of-bounds read via the aiString argument. Local access required; exploit public.
Risk Assessment
Local attackers may read memory contents, leading to information disclosure.
Recommendation
Apply the available patch or update Assimp to a fixed version.
Original NVD description (English source)
A security vulnerability has been detected in Assimp up to 6.0.4. Affected by this issue is the function HL1MDLLoader::read_sequence_infos of the file HL1MDLLoader.cpp of the component Half-Life 1 MDL Loader. The manipulation of the argument aiString leads to out-of-bounds read. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The project tagged the reported issue as bug.