CVE-2026-10198: Assimp Null Pointer Dereference Flaw

CVE-2026-10198 Overview

CVE-2026-10198 is a null pointer dereference vulnerability in the Open Asset Import Library (Assimp) up to version 6.0.4. The flaw resides in the Assimp::glTFImporter::ImportMeshes function inside glTFImporter.cpp, part of the glTFImporter component. Processing a crafted glTF asset triggers a null pointer dereference and crashes the host process. Exploitation requires local execution and low privileges, and no remote attack vector exists. A proof-of-concept has been published, and the Assimp project tracks the report as a bug. The defect is classified under CWE-404: Improper Resource Shutdown or Release.

Critical Impact
Local processing of a malicious glTF model can crash any application that links Assimp 6.0.4 or earlier, causing denial of service in 3D asset pipelines.

Affected Products

Assimp (Open Asset Import Library) versions up to and including 6.0.4
Applications embedding the vulnerable glTFImporter component
Build pipelines and asset tools that parse untrusted glTF files via Assimp

Discovery Timeline

2026-05-31 - CVE-2026-10198 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-10198

Vulnerability Analysis

The defect lives in Assimp::glTFImporter::ImportMeshes within glTFImporter.cpp. The function dereferences a pointer that can be null when a malformed glTF asset omits or misorders required mesh, accessor, or buffer view structures. Because Assimp is consumed as a library by 3D engines, CAD tools, model viewers, and game asset converters, any process that loads attacker-supplied glTF data will terminate when the dereference occurs. The exploit is published, so reliable triggers are already available to researchers and adversaries. According to the EPSS forecast, in-the-wild exploitation remains unlikely, and the issue is limited to availability impact on a local process.

Root Cause

The importer assumes that pointers retrieved from the parsed glTF object graph are valid before access. It omits a null check on a structure produced during mesh ingestion, which violates CWE-404 handling expectations. When the parser returns a null reference, the subsequent member access faults.

Attack Vector

An attacker with local access supplies a crafted glTF file to an application that uses Assimp to import meshes. The application calls ImportMeshes, hits the null dereference, and terminates. There is no remote network path, no authentication bypass, and no code execution primitive documented in the advisory. The published proof-of-concept is distributed as a glTF sample archive referenced by the Assimp GitHub Issue #6609.

No verified exploit code is available for inclusion. Refer to the VulDB CVE-2026-10198 entry for additional technical context.

Detection Methods for CVE-2026-10198

Indicators of Compromise

Unexpected crashes or segmentation faults in processes that import glTF assets via Assimp
Presence of untrusted .gltf or .glb files matching the published proof-of-concept archive
Crash dumps with faulting frames inside glTFImporter::ImportMeshes in glTFImporter.cpp

Detection Strategies

Inventory binaries and containers that statically or dynamically link Assimp at or below version 6.0.4.
Hash-match the bundled assimp library against known vulnerable builds during software composition analysis scans.
Hook crash reporters to flag faults whose call stack includes Assimp::glTFImporter::ImportMeshes.

Monitoring Recommendations

Forward application crash telemetry and Windows Error Reporting or Linux core dumps to a central log store for stack-frame inspection.
Alert on repeated abnormal terminations of asset importers, model viewers, or build agents handling user-supplied 3D files.
Track file write events for .gltf and .glb files in directories consumed by automated build or rendering pipelines.

How to Mitigate CVE-2026-10198

Immediate Actions Required

Identify every application and service that bundles Assimp 6.0.4 or earlier and prioritize remediation for components that parse untrusted glTF input.
Restrict who can drop glTF files into directories consumed by Assimp-based tools to reduce local exposure.
Validate or sandbox glTF parsing in a low-privilege process so a crash does not interrupt critical pipelines.

Patch Information

No fixed Assimp release is referenced in the NVD entry at publication. Track the Assimp upstream repository and Issue #6609 for a commit that adds the missing null check in ImportMeshes. Rebuild and redistribute downstream applications once a patched version is tagged.

Workarounds

Disable the glTF importer in Assimp builds where 3D glTF support is not required.
Run asset import operations in an isolated process with automatic restart so a null dereference does not affect the parent application.
Apply file-type allowlists and reject glTF files from untrusted users until a fixed Assimp version is deployed.

bash

# Configuration example: disable glTF importer at build time
cmake -S . -B build \
  -DASSIMP_BUILD_GLTF_IMPORTER=OFF \
  -DASSIMP_BUILD_TESTS=OFF
cmake --build build --config Release