Quick answers
- Is CVE-2026-10197 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-10197 being exploited in the wild.
- How severe is CVE-2026-10197?
- Low severity, with a CVSS score of 3.3, published 31 May 2026.
- Which products and versions are affected?
- Assimp up to 6.0.4.
- Is there a fix for CVE-2026-10197?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-10197 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-10197?
- Check whether you run Assimp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A null pointer dereference exists in Assimp up to version 6.0.4 within the glTF2Importer::ImportEmbeddedTextures function located in code/AssetLib/glTF2/glTF2Importer.cpp. The vulnerability is triggered when a glTF2 file contains a 'mimeType' string that lacks the expected '/' delimiter. The code performs pointer arithmetic on the result of strchr() without verifying if the character was found, leading to an invalid memory access (dereferencing 0x1) during a subsequent strncmp call. An attacker with local access can provide a malformed file to cause a crash (Denial of Service). A patch has been proposed in pull request #6645 to validate the strchr result before use.
Affected products
- Assimp Assimp up to 6.0.4
Timeline
- 2026-05-12: other: Issue reported and pull request created on GitHub
- 2026-05-31: advisory: Vulnerability published in VulDB and NVD