CVE-2026-117608

A flaw was found in assimp. An attacker can exploit an integer overflow in the MD2 file parser by providing a specially crafted 3D model file with manipulated header values. When processed, this vulnerability triggers an out-of-bounds memory read, resulting in a Denial of Service (DoS) through an application crash or the potential disclosure of sensitive memory.

This vulnerability is rated as Moderate impact because exploitation requires a user or application to process an untrusted 3D asset file, limiting the blast radius to process termination or localized memory disclosure without code execution. Within Red Hat Enterprise Linux, the impacted parsing routine is embedded within graphical and 3D rendering frameworks such as Qt rather than network-facing system daemons. As a result, the risk is confined to local applications that explicitly load third-party model data.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.