CVE-2026-19999

CVE-2026-19999 is a buffer overflow in Assimp's MDL7 parser, specifically in the bone transformation key handling where a count field controls how many transformation matrices get written into a pre-allocated buffer without adequate bounds validation. The patch exists, but the vulnerability's true danger lies in what makes it unusual: MDL7 is a dead format from id Software's Quake III toolchain, abandoned by its creators in 2002, yet the parser remains compiled into every application that links Assimp statically—and the code path is reachable through Assimp's format auto-detection layer even when users never intentionally load an MDL7 file. This is the critical insight the CVE description alone won't tell you: the attack surface is not 'systems that process MDL7 files.' It's every system that processes untrusted binary input through Assimp, because the parser fork is chosen after the file header is inspected. A malformed file targeting MDL7-specific code can invoke that parser through auto-detection without any user knowledge or consent. Your 3D asset pipeline, your web server handling model uploads, your CAD tool importing a colleague's design—all of these expose the MDL7 overflow path if Assimp is in the chain, regardless of whether MDL7 is a format anyone actively uses. The CVSS 6.3 MEDIUM rating compounds the danger through institutional misperception. Security teams deprioritize medium-rated CVEs in legacy format parsers, especially when the affected format is deprecated. The remediation velocity will be slowest precisely where the blast radius is largest: game engines shipped in compiled products, CAD applications deployed behind change management processes, embedded systems that never receive updates. Static linking transforms this from a patchable vulnerability into structural debt—the fix exists, but the vulnerable code is now baked into thousands of binaries that will never rebuild. Check your dependencies: if Assimp is statically linked in any product processing untrusted 3D assets, treat this as a high-priority rebuild regardless of whether MDL7 is in your active workflow. The code path executes whether you intend it or not.

Reviewed through automated stages and approved by a human before publication.