Junglewise Threat Intelligence

CVE-2026-10199: Assimp null pointer dereference in glTF2Asset.h

CVE-2026-10199 · Severity: low · CVSS 3.3 · Published 2026-05-31

Technologies: Assimp. Vendors: Assimp.

Executive brief

Assimp is a widely used library for importing various 3D model formats into applications. A vulnerability was found where processing a specially crafted glTF 3D file can cause the application to crash. This could lead to a denial-of-service, potentially disrupting operations or causing data loss in software that relies on Assimp to process 3D assets.

Technical details

A null pointer dereference exists in Assimp up to version 6.0.4 within the glTF2Importer::ImportAnimations function in glTF2Asset.h. The vulnerability is triggered when a glTF2 animation channel references a node index that is missing or null in the nodes array, causing the LazyDict::operator[] to dereference a null pointer. An attacker can exploit this by providing a malformed glTF file, leading to a denial-of-service (application crash). The issue has been addressed in commit d24b85319bd70c65883a2b96613e07e23fb95981 by implementing proper validation of the node reference before dereferencing.

Affected products

  • Assimp Assimp up to 6.0.4

Timeline

  • 2026-05-12: other: Issue reported and pull request created
  • 2026-05-26: patched: Fix merged into master branch
  • 2026-05-31: disclosed: Vulnerability disclosed and CVE assigned

References

Related threats