OSV-2026-867

See a problem?
Import Source
https://github.com/google/oss-fuzz-vulns/blob/main/vulns/assimp/OSV-2026-867.yaml
JSON Data
https://api.osv.dev/v1/vulns/OSV-2026-867
Published
2026-06-07T00:02:11Z
Modified
2026-10-24T16:15:02Z
Summary
Bad-cast to std::__shared_weak_count from invalid vptr
Details

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=520147546

Crash type: Bad-cast
Crash state:
Bad-cast to std::__shared_weak_count from invalid vptr
std::__1::shared_ptr<Assimp::STEP::EXPRESS::DataType const>::shared_ptr
Assimp::STEP::ReadFileHeader
References

Affected packages

OSS-Fuzz / assimp

Package

Name
assimp
Purl
pkg:generic/assimp

Affected ranges

Type
GIT
Repo
https://github.com/assimp/assimp.git
Events
Introduced
cac67afe479ac9be595d03bfa811d0e6a6baf39a
Fixed
d59e42da06d4e182845aa47dab5848269efd998d

Ecosystem specific 

{
    "severity":  "HIGH"
}

Database specific

fixed_range 
"c3f68d29c4237435652ec242e00928d5dd2b3011:d59e42da06d4e182845aa47dab5848269efd998d"
introduced_range 
"be3d938e3e22d364b38807a247b3593fa7b260bd:626219cdd32f8fb0891464f27663d2667078d7cc"
source 
"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/assimp/OSV-2026-867.yaml"