Executive brief
Assimp, a widely used library for importing 3D model formats, contains a flaw in how it handles glTF files. An attacker could provide a specially crafted 3D file that causes the application using Assimp to crash. This results in a denial-of-service, potentially disrupting operations or software that relies on 3D asset processing.
Technical details
A null pointer dereference exists in the Assimp::glTFImporter::ImportMeshes function within glTFImporter.cpp. The vulnerability is caused by an unchecked return value from the ExtractData() function when processing texture coordinates. If ExtractData() fails due to an invalid bufferView or missing data, it returns a null pointer which is subsequently dereferenced. This issue can be triggered locally by providing a malformed glTF file, leading to a denial-of-service (crash). A proof-of-concept exploit has been publicly disclosed.
Affected products
- Assimp Assimp up to 6.0.4
Timeline
- 2026-04-24: disclosed: Issue reported on GitHub repository
- 2026-05-31: advisory: CVE published by VulDB/NVD