Assimp glTFImporter glTFImporter.cpp ImportMeshes null pointer dereference_CVE-2026-10198

4.8 / 10

MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

Description

A flaw has been found in Assimp up to 6.0.4. Affected by this vulnerability is the function Assimp::glTFImporter::ImportMeshes of the file glTFImporter.cpp of the component glTFImporter. This manipulation causes null pointer dereference. The attack is restricted to local execution. The exploit has been published and may be used. The project tagged the reported issue as bug.

Basic Information

ID CVE-2026-10198

Source VulDB

Published May 31, 2026 at 22:15

Affected Product

Vendor n/a

Product Assimp

Version 6.0.0

Affected Versions n/a Assimp 6.0.0
n/a Assimp 6.0.1
n/a Assimp 6.0.2
n/a Assimp 6.0.3
n/a Assimp 6.0.4

CWE Classification

CWE-476 CWE-404

References

{
    "lastseen": "",
    "description": "A flaw has been found in Assimp up to 6.0.4. Affected by this vulnerability is the function Assimp::glTFImporter::ImportMeshes of the file glTFImporter.cpp of the component glTFImporter. This manipulation causes null pointer dereference. The attack is restricted to local execution. The exploit has been published and may be used. The project tagged the reported issue as bug.",
    "published": "2026-05-31T22:15:12.239Z",
    "modified": "2026-05-31T22:15:12.239Z",
    "type": "cve",
    "title": "Assimp glTFImporter glTFImporter.cpp ImportMeshes null pointer dereference",
    "source": "VulDB",
    "references": "https://vuldb.com/vuln/367478\nhttps://vuldb.com/vuln/367478/cti\nhttps://vuldb.com/cve/CVE-2026-10198\nhttps://vuldb.com/submit/821178\nhttps://github.com/assimp/assimp/issues/6609\nhttps://github.com/user-attachments/files/27193865/poc.zip\nhttps://github.com/assimp/assimp/",
    "id": "CVE-2026-10198",
    "bulletinFamily": "",
    "cwe": [
        "CWE-476",
        "CWE-404"
    ],
    "cvelist": null,
    "sourceData": "n/a Assimp 6.0.0\nn/a Assimp 6.0.1\nn/a Assimp 6.0.2\nn/a Assimp 6.0.3\nn/a Assimp 6.0.4",
    "sourceHref": "",
    "cvss": {
        "score": 4.8,
        "severity": "MEDIUM",
        "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "Assimp",
    "version": "6.0.0",
    "vendor": "n/a",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}