Log in Start free

Vulnerability · Published May 31, 2026 · Assigned by VulDB

CVE-2026-10199Assimp glTF2Asset.h LazyDict null pointer dereference

Low 3.3

In plain English

A low-severity null pointer dereference in Assimp. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.1%top 98.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in Assimp up to 6.0.4. Affected by this issue is the function glTF2::LazyDict in the library glTF2Asset.h. Such manipulation of the argument operator[] leads to null pointer dereference. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The name of the patch is d24b85319bd70c65883a2b96613e07e23fb95981. It is best practice to apply a patch to resolve this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12assimpno fix listedDEBIAN-CVE-2026-10199
Debian:13assimpno fix listedDEBIAN-CVE-2026-10199
Debian:14assimpno fix listedDEBIAN-CVE-2026-10199
Ubuntu:22.04:LTSassimpno fix listedUBUNTU-CVE-2026-10199
Ubuntu:24.04:LTSassimpno fix listedUBUNTU-CVE-2026-10199
Ubuntu:25.10assimpno fix listedUBUNTU-CVE-2026-10199
Ubuntu:26.04:LTSassimpno fix listedUBUNTU-CVE-2026-10199
Ubuntu:26.10assimpno fix listedUBUNTU-CVE-2026-10199

Affected products (as reported)

VendorProductVersions
n/a Assimp 6.0.06.0.16.0.26.0.36.0.4

Weakness: CWE-476, CWE-404 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

References