CVE-2026-10197

LowCVSS 3.3

Published: 31/05/2026(UTC)Updated: 22/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.12%

2th percentile - higher than 2% of all known CVEs

Summary

A vulnerability in Assimp up to version 6.0.4 affects the glTF2Importer::ImportEmbeddedTextures function in glTF2Importer.cpp, causing a null pointer dereference. Local access is required, and the exploit is public.

Risk Assessment

A local attacker could crash the application (denial of service) by triggering a null pointer dereference.

Recommendation

Implement the patch from the pending pull request to fix this vulnerability.

Original NVD description (English source)

A vulnerability was detected in Assimp up to 6.0.4. Affected is the function glTF2Importer::ImportEmbeddedTextures in the library code/AssetLib/glTF2/glTF2Importer.cpp of the component TF File Handler. The manipulation results in null pointer dereference. The attack is only possible with local access. The exploit is now public and may be used. It is advisable to implement a patch to correct this issue. The pull request to fix this issue awaits acceptance.