CVE-2026-10198

A flaw has been found in Assimp up to 6.0.4. Affected by this vulnerability is the function Assimp::glTFImporter::ImportMeshes of the file glTFImporter.cpp of the component glTFImporter. This manipulation causes null pointer dereference. The attack is restricted to local execution. The exploit has been published and may be used. The project tagged the reported issue as bug.

Database specific

{
    "cwe_ids": [
        "CWE-404",
        "CWE-476"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10198.json",
    "cna_assigner": "VulDB"
}

References

Affected packages

Git / github.com/assimp/assimp

Affected ranges

Type

GIT

Repo

https://github.com/assimp/assimp

Events

Introduced

c4515f53ca9a60cf4645b9bc837faaf14026b6d1

Last affected

e0b52347c6e52de2827ec957a9ebf00ce3c54f79

Database specific

{
    "extracted_events": [
        {
            "introduced": "6.0.0"
        },
        {
            "last_affected": "6.0.0"
        },
        {
            "introduced": "6.0.1"
        },
        {
            "last_affected": "6.0.1"
        },
        {
            "introduced": "6.0.2"
        },
        {
            "last_affected": "6.0.2"
        },
        {
            "introduced": "6.0.3"
        },
        {
            "last_affected": "6.0.3"
        },
        {
            "introduced": "6.0.4"
        },
        {
            "last_affected": "6.0.4"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

6.*

6.0.0

6.0.1

6.0.2

6.0.3

6.0.4

v6.*

v6.0.0

v6.0.1

v6.0.2

v6.0.3

v6.0.4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10198.json"