CVE-2026-10198

Assimp glTFImporter glTFImporter.cpp ImportMeshes null pointer dereference

State: Published
Severity: 4.8 Medium
Published: May 31, 2026
Updated: Jun 1, 2026
Reserved: May 31, 2026

Description

A flaw has been found in Assimp up to 6.0.4. Affected by this vulnerability is the function Assimp::glTFImporter::ImportMeshes of the file glTFImporter.cpp of the component glTFImporter. This manipulation causes null pointer dereference. The attack is restricted to local execution. The exploit has been published and may be used. The project tagged the reported issue as bug.

Scores

CVSS	Score	Vector	Source
4.0	4.8 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	3.3 Low	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R	VulDB
3.0	3.3 Low	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R	VulDB
2.0	1.7 Low	AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-476 NULL Pointer Dereference
CWE-404 Denial of Service

Affected Products

Product	Versions
Assimpn/a	6.0.0Affected 6.0.1Affected 6.0.2Affected 6.0.3Affected 6.0.4Affected

References

VDB-367478 | Assimp glTFImporter glTFImporter.cpp ImportMeshes null pointer dereferencevdb-entrytechnical-description
VDB-367478 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
CVE-2026-10198 | CVE Analysis and Reportthird-party-advisory
Submit #821178 | Assimp commit 17c12da NULL Pointer Dereferencethird-party-advisory
https://github.com/assimp/assimp/issues/6609issue-tracking
https://github.com/user-attachments/files/27193865/poc.zipexploit
https://github.com/assimp/assimp/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.