CVE-2026-14610 Open Asset Import Library Assimp CSM File CSMLoader.cpp InternReadFile heap-based overflow

A flaw has been found in Open Asset Import Library Assimp up to 6.0.5. Impacted is the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. This manipulation causes heap-based buffer overflow. The attack is restricted to local...

OSV-2026-846 Bad-cast to AMFColor from AMFMetadata

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=519360629 Crash type: Bad-cast Crash state: Bad-cast to AMFColor from AMFMetadata Assimp::AMFImporter::SPPMaterial::GetColor Assimp::AMFImporter::PostprocessBuildMeshSet...

PT-2026-52533

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=519360629 Crash type: Bad-cast Crash state: Bad-cast to AMFColor from AMFMetadata Assimp::AMFImporter::SPP Material::GetColor Assimp::AMFImporter::Postprocess BuildMeshSet...

SUSE CVE-2025-70067

Buffer Overflow vulnerability exists in Assimp versions up to 6.0.2 in the FBX Importer. The vulnerability occurs in aiMaterial::AddBinaryProperty, where a property key string from a crafted FBX file is copied into a fixed-size heap buffer using strcpy without runtime length validation...

CVE-2025-70067

Buffer Overflow vulnerability exists in Assimp versions up to 6.0.2 in the FBX Importer. The vulnerability occurs in aiMaterial::AddBinaryProperty, where a property key string from a crafted FBX file is copied into a fixed-size heap buffer using strcpy without runtime length validation...

PYSEC-2022-43149

Open Asset Import Library assimp commit 3c253ca was discovered to contain a segmentation violation via the component Assimp::XFileImporter::CreateMeshes...