What’s Vulnerable › Vulnerabilities

CVE-2026-10233: Assimp Half-Life 1 MDL Loader HL1MDLLoader.cpp read_sequence_infos out-of-bounds

• Severity: low (CVSS 3.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-01 · updated 2026-07-22
• Weakness: CWE-119

Description

A security vulnerability has been detected in Assimp up to 6.0.4. Affected by this issue is the function HL1MDLLoader::read_sequence_infos of the file HL1MDLLoader.cpp of the component Half-Life 1 MDL Loader. The manipulation of the argument aiString leads to out-of-bounds read. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The project tagged the reported issue as bug.

Affected products

• Assimp: 6.0.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4

References

• https://github.com/assimp/assimp/
• https://github.com/assimp/assimp/issues/6619
• https://github.com/user-attachments/files/27228962/poc.zip
• https://vuldb.com/cve/CVE-2026-10233
• https://vuldb.com/submit/821196
• https://vuldb.com/vuln/367512
• https://vuldb.com/vuln/367512/cti
• https://github.com/assimp/assimp/issues/6619

Get alerted when CVE-2026-10233 or the next vulnerability affects your stack