CVE-2026-10197
Low · 3.3CVSS
3.3
EPSS
0.1%
Published
May 31, 2026
CISA due date
—
The record
A vulnerability was detected in Assimp up to 6.0.4. Affected is the function glTF2Importer::ImportEmbeddedTextures in the library code/AssetLib/glTF2/glTF2Importer.cpp of the component TF File Handler. The manipulation results in null pointer dereference. The attack is only possible with local access. The exploit is now public and may be used. It is advisable to implement a patch to correct this issue. The pull request to fix this issue awaits acceptance.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | assimp | 0 | 6.0.5-3.1 |
Related vulnerabilities
- CVE-2026-10232 A weakness has been identified in Assimp up to 6.0.4. Also affects assimp
- CVE-2026-10199 A vulnerability has been found in Assimp up to 6.0.4. Also affects assimp
- CVE-2026-10200 A vulnerability was found in Assimp up to 6.0.4. Also affects assimp
- CVE-2025-70067 Buffer Overflow vulnerability exists in Assimp versions up to 6.0.2 in the FBX Importer. Also affects assimp
- CVE-2024-53425 A heap-buffer-overflow vulnerability was discovered in the SkipSpacesAndLineEnd function… Also affects assimp
- CVE-2024-48424 A heap-buffer-overflow vulnerability has been identified in the… Also affects assimp
- CVE-2024-48425 A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle… Also affects assimp
- CVE-2024-48426 A segmentation fault (SEGV) was detected in the SortByPTypeProcess::Execute function in… Also affects assimp