CVE-2026-10197

Assimp TF File glTF2Importer.cpp ImportEmbeddedTextures null pointer dereference

State: Published
Severity: 4.8 Medium
Published: May 31, 2026
Updated: Jun 1, 2026
Reserved: May 31, 2026

Description

A vulnerability was detected in Assimp up to 6.0.4. Affected is the function glTF2Importer::ImportEmbeddedTextures in the library code/AssetLib/glTF2/glTF2Importer.cpp of the component TF File Handler. The manipulation results in null pointer dereference. The attack is only possible with local access. The exploit is now public and may be used. It is advisable to implement a patch to correct this issue. The pull request to fix this issue awaits acceptance.

Scores

CVSS	Score	Vector	Source
4.0	4.8 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	3.3 Low	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C	VulDB
3.0	3.3 Low	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C	VulDB
2.0	1.7 Low	AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-476 NULL Pointer Dereference
CWE-404 Denial of Service

Affected Products

Product	Versions
Assimpn/a	6.0.0Affected 6.0.1Affected 6.0.2Affected 6.0.3Affected 6.0.4Affected

References

VDB-367477 | Assimp TF File glTF2Importer.cpp ImportEmbeddedTextures null pointer dereferencevdb-entrytechnical-description
VDB-367477 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
CVE-2026-10197 | CVE Analysis and Reportthird-party-advisory
Submit #821177 | Assimp commit 17c12da NULL Pointer Dereferencethird-party-advisory
https://github.com/assimp/assimp/issues/6608issue-tracking
https://github.com/user-attachments/files/27193894/poc.zipexploit
https://github.com/assimp/assimp/pull/6645issue-trackingpatch
https://github.com/assimp/assimp/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.