CVE-2026-82591: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-82591 is a heap-based buffer overflow vulnerability in the Open Asset Import Library (Assimp) affecting versions 6.0.0 through 6.0.2. The flaw resides in the MD5Importer::MakeDataUnique() function within code/AssetLib/MD5/MD5Loader.cpp, where improper sizing of the vertex output array allows the write cursor (iNewIndex) to exceed heap allocation boundaries when processing malformed .md5mesh files. It was disclosed on August 30, 2026, with a patch merged on August 4, 2026. The vulnerability carries a CVSS v3.1 score of 5.3 (Medium) and a CVSS v4.0 score of 4.8 (Medium) (Github Advisory, Feedly).

The root cause is classified as CWE-122 (Heap-based Buffer Overflow) and CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). In MakeDataUnique(), the vertex output array was resized to faces * 3 elements, but the append cursor iNewIndex was initialized to the original vertex count (meshSrc.mVertices.size()). When a malformed MD5MESH file declares more vertices than triangle corners, or leaves vertices unreferenced, iNewIndex starts at or above the resized array boundary, causing the first duplicate vertex write (mVertices[iNewIndex] = ...) to overflow the heap buffer — confirmed by AddressSanitizer as a WRITE of size 16 at MD5Loader.cpp:251. The vulnerability was discovered via AddressSanitizer combined with libFuzzer fuzzing of the MD5 importer (GitHub PR #6718, Patch Commit). Exploitation requires local access and low privileges, as an attacker must supply a crafted asset file to an application that uses the vulnerable Assimp library.

Successful exploitation can result in arbitrary code execution, heap memory corruption, or denial of service on systems running vulnerable versions of Assimp. The impact is limited to the vulnerable system (no subsequent system impact), with low confidentiality, integrity, and availability effects per CVSS v4.0 scoring. Applications that process untrusted 3D asset files — such as game engines, 3D editors, or content pipelines — are at risk if they embed Assimp 6.0.0–6.0.2 (Github Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). The EPSS score is 0.0, indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained to local access with low privileges, significantly limiting the attack surface.

1. Craft a malicious MD5MESH file: Create a .md5mesh file that declares more vertices than triangle corners, or includes unreferenced vertices, so that the original vertex count exceeds faces * 3.
2. Deliver the file to the target: Place the crafted file in a location accessible to an application using Assimp 6.0.0–6.0.2 (e.g., a game asset directory, a 3D editor project folder, or a content pipeline input).
3. Trigger file import: Cause the target application to load the malicious .md5mesh file, invoking MD5Importer::InternReadFile() → LoadMD5MeshFile() → MakeDataUnique().
4. Trigger heap overflow: The iNewIndex cursor starts at the original vertex count, which exceeds the resized array size (faces * 3), causing the first mVertices[iNewIndex] = ... write to overflow the heap buffer.
5. Achieve impact: Depending on heap layout and application context, this may result in a crash (denial of service), heap metadata corruption, or potentially arbitrary code execution (GitHub PR #6718, Patch Commit).

• Process: Application crash or abnormal termination when loading .md5mesh files; AddressSanitizer reports of heap-buffer-overflow WRITE of size 16 in MD5Loader.cpp:251 if the application is instrumented.
• Logs: Application error logs showing DeadlyImportError exceptions from the Assimp MD5 importer (post-patch behavior for malformed files); crash dumps referencing Assimp::MD5Importer::MakeDataUnique or MD5Loader.cpp.
• File System: Presence of unexpected or externally supplied .md5mesh files in asset directories processed by Assimp-based applications.

Apply the patch commit bf9dabb617c46e5133dac65cca6bff177917afcb, which was merged into the Assimp master branch on August 4, 2026, via PR #6718. The fix resizes the vertex array to the true worst case (numOrigVerts + faces * 3) and trims it to the actual produced count, adds overflow guards, and validates face indices against the original vertex count. Until a patched release is available, restrict local access to systems running vulnerable Assimp versions, avoid processing untrusted .md5mesh files, and implement input validation for MD5 asset files at the application layer (GitHub PR #6718, Patch Commit).