CVE-2026-10198

1.9 lowEPSS 0.1%

A flaw has been found in Assimp up to 6.0.4. Affected by this vulnerability is the function Assimp::glTFImporter::ImportMeshes of the file glTFImporter.cpp of the component glTFImporter. This manipulation causes null pointer dereference. The attack is restricted to local execution. The exploit has been published and may be used. The project tagged the reported issue as bug.

Severity

CVSS 4.0

1.9 low

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

3.3 low

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

EPSS: 0.1% chance of exploitation in the next 30 days; higher than 1% of CVEs (scores of 2026-10-31)
CWEs: CWE-404, CWE-476
Published: 2026-05-31
Modified: 2026-07-22
Record from: the NVD, synced 2026-10-19

References

https://github.com/assimp/assimp/
https://github.com/assimp/assimp/issues/6609
https://github.com/user-attachments/files/27193865/poc.zip
https://vuldb.com/cve/CVE-2026-10198
https://vuldb.com/submit/821178

Check your stack JSON