CVE-2026-10199
Low · 3.3CVSS
3.3
EPSS
0.1%
Published
May 31, 2026
CISA due date
—
The record
A vulnerability has been found in Assimp up to 6.0.4. Affected by this issue is the function glTF2::LazyDict in the library glTF2Asset.h. Such manipulation of the argument operator[] leads to null pointer dereference. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The name of the patch is d24b85319bd70c65883a2b96613e07e23fb95981. It is best practice to apply a patch to resolve this issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | assimp | 0 | 6.0.5-3.1 |
Related vulnerabilities
- CVE-2026-10232 A weakness has been identified in Assimp up to 6.0.4. Also affects assimp
- CVE-2026-10200 A vulnerability was found in Assimp up to 6.0.4. Also affects assimp
- CVE-2026-10197 A vulnerability was detected in Assimp up to 6.0.4. Also affects assimp
- CVE-2025-70067 Buffer Overflow vulnerability exists in Assimp versions up to 6.0.2 in the FBX Importer. Also affects assimp
- CVE-2024-53425 A heap-buffer-overflow vulnerability was discovered in the SkipSpacesAndLineEnd function… Also affects assimp
- CVE-2024-48424 A heap-buffer-overflow vulnerability has been identified in the… Also affects assimp
- CVE-2024-48425 A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle… Also affects assimp
- CVE-2024-48426 A segmentation fault (SEGV) was detected in the SortByPTypeProcess::Execute function in… Also affects assimp