Log in Start free

Vulnerability · Published May 31, 2026 · Assigned by VulDB

CVE-2026-10198Assimp glTFImporter glTFImporter.cpp ImportMeshes null pointer dereference

Low 3.3

In plain English

A low-severity null pointer dereference in Assimp. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.1%top 98.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A flaw has been found in Assimp up to 6.0.4. Affected by this vulnerability is the function Assimp::glTFImporter::ImportMeshes of the file glTFImporter.cpp of the component glTFImporter. This manipulation causes null pointer dereference. The attack is restricted to local execution. The exploit has been published and may be used. The project tagged the reported issue as bug.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12assimpno fix listedDEBIAN-CVE-2026-10198
Debian:13assimpno fix listedDEBIAN-CVE-2026-10198
Debian:14assimpno fix listedDEBIAN-CVE-2026-10198
Ubuntu:22.04:LTSassimpno fix listedUBUNTU-CVE-2026-10198
Ubuntu:24.04:LTSassimpno fix listedUBUNTU-CVE-2026-10198
Ubuntu:25.10assimpno fix listedUBUNTU-CVE-2026-10198
Ubuntu:26.04:LTSassimpno fix listedUBUNTU-CVE-2026-10198
Ubuntu:26.10assimpno fix listedUBUNTU-CVE-2026-10198

Affected products (as reported)

VendorProductVersions
n/a Assimp 6.0.06.0.16.0.26.0.36.0.4

Weakness: CWE-476, CWE-404 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R

References