CVE-2026-10198CWE-404CWE-476

Assimp glTFImporter glTFImporter.cpp ImportMeshes null pointer dereference

Medium · published May 31, 2026

CVSS v4.0
4.8
EPSS
0%
Percentile
1.4
In the wild
Unconfirmed
What it is

A flaw has been found in Assimp up to 6.0.4. Affected by this vulnerability is the function Assimp::glTFImporter::ImportMeshes of the file glTFImporter.cpp of the component glTFImporter. This manipulation causes null pointer dereference. The attack is restricted to local execution. The exploit has been published and may be used. The project tagged the reported issue as bug.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00113 · 1.4th percentile
Weaknesses
CWE-404 · Improper Resource Shutdown or Release; CWE-476 · NULL Pointer Dereference
Published
2026-05-31T22:15Z
EPSS history
Timeline
  • 31 MAY 22:15Z
    Assimp glTFImporter glTFImporter.cpp ImportMeshes null pointer dereference
    cvelistv5