CVE-2026-10199

EUVD-2026-33521

31.05.2026, 23:16

A vulnerability has been found in Assimp up to 6.0.4. Affected by this issue is the function glTF2::LazyDict in the library glTF2Asset.h. Such manipulation of the argument operator[] leads to null pointer dereference. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The name of the patch is d24b85319bd70c65883a2b96613e07e23fb95981. It is best practice to apply a patch to resolve this issue.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	3.3 LOW	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 1.92%

Debian Releases

Debian Product

Codename

assimp

bookworm	no-dsa
bullseye	postponed
forky	vulnerable
sid	vulnerable
trixie	no-dsa

Ubuntu Releases

Ubuntu Product

Codename

assimp

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
questing	ignored
resolute	needs-triage
xenial	needs-triage

Common Weakness Enumeration

CWE-404 - Improper Resource Shutdown or Release
The program does not release or incorrectly releases a resource before it is made available for re-use.

References

https://github.com/assimp/assimp/

https://github.com/assimp/assimp/commit/d24b85319bd70c65883a2b96613e07e23fb95981

https://github.com/assimp/assimp/issues/6611

https://github.com/assimp/assimp/pull/6646

https://github.com/user-attachments/files/27194148/poc.zip

https://vuldb.com/cve/CVE-2026-10199

https://vuldb.com/submit/821179

https://vuldb.com/vuln/367479

https://vuldb.com/vuln/367479/cti