CVE-2026-10201: Assimp Divide by Zero Vulnerability

CVE-2026-10201 Overview

CVE-2026-10201 is a divide-by-zero vulnerability in Assimp (Open Asset Import Library) versions up to 6.0.4. The flaw resides in the FBXExporter::WriteObjects function within FBXExporter.cpp, specifically in the UV Channel Handler component. An attacker with local access and low privileges can trigger the condition by supplying a crafted input that causes a divide-by-zero arithmetic fault [CWE-369]. The Assimp project has tagged the reported issue as a bug, and a patch is available. A public proof-of-concept has been disclosed, increasing the likelihood of opportunistic exploitation against applications that embed vulnerable Assimp builds.

Critical Impact
Local attackers can crash applications that use Assimp 6.0.4 or earlier by exporting FBX files with malformed UV channel data, resulting in denial of service in 3D asset processing pipelines.

Affected Products

Assimp (Open Asset Import Library) versions up to and including 6.0.4
Applications embedding the affected Assimp FBX exporter component
3D content pipelines and asset converters built on Assimp

Discovery Timeline

2026-06-01 - CVE-2026-10201 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-10201

Vulnerability Analysis

The vulnerability exists in the FBX export path of Assimp. When FBXExporter::WriteObjects processes scene data containing UV channel information, the function performs an arithmetic operation that does not validate its divisor. If a crafted asset produces a zero value where the code expects a non-zero count or stride, the resulting divide-by-zero exception terminates the host process. The condition is classified under [CWE-369] Divide By Zero. Because Assimp is widely embedded into game engines, modeling tools, and rendering pipelines, the bug surfaces in any downstream application that invokes FBX export on attacker-controlled scene graphs.

Root Cause

The root cause is missing validation of a divisor value derived from UV channel metadata inside FBXExporter.cpp. The exporter assumes a non-zero element count or layout descriptor when writing the UV channel block. When that assumption is broken by a malformed or empty UV channel definition, the integer division produces an unhandled arithmetic exception. No bounds or sanity check guards the operation prior to division.

Attack Vector

Exploitation requires local access with low privileges. An attacker supplies a crafted scene or model file to an application that invokes Assimp's FBX exporter. When the exporter reaches the UV channel serialization code path in WriteObjects, the divide-by-zero is triggered and the process aborts. The impact is limited to availability — the bug does not provide a primitive for code execution, memory disclosure, or integrity compromise. A public proof-of-concept archive is referenced in the GitHub Issue #6613 discussion.

No verified exploit code is reproduced here. Refer to the VulDB CVE-2026-10201 entry and the upstream issue for technical details.

Detection Methods for CVE-2026-10201

Indicators of Compromise

Unexpected process termination of applications or build tools that invoke Assimp FBX export routines.
Crash dumps containing stack frames from FBXExporter::WriteObjects in FBXExporter.cpp.
FBX or intermediate scene files with zero-length or malformed UV channel definitions submitted to asset conversion pipelines.

Detection Strategies

Inventory all applications, plugins, and CI/CD asset pipelines that statically or dynamically link Assimp 6.0.4 or earlier.
Hash known vulnerable assimp shared libraries and flag their presence on developer workstations and build agents.
Hunt for arithmetic exception crash signatures (SIGFPE on Linux/macOS, EXCEPTION_INT_DIVIDE_BY_ZERO on Windows) originating from Assimp modules.

Monitoring Recommendations

Forward crash reporting and Windows Error Reporting (WER) telemetry to a central log store and alert on Assimp-related fault buckets.
Monitor file submission queues that feed 3D asset converters for files originating from untrusted users.
Track upstream Assimp release tags and security advisories on the Assimp GitHub Repository.

How to Mitigate CVE-2026-10201

Immediate Actions Required

Identify and upgrade Assimp dependencies in all internal applications, build pipelines, and shipped products to a patched version beyond 6.0.4.
Restrict who can submit FBX or scene files to systems that run Assimp's FBX exporter, particularly multi-tenant build hosts.
Add input validation in calling applications to reject scene graphs with empty or malformed UV channel definitions before invoking the exporter.

Patch Information

The Assimp project has acknowledged the issue and a fix has been committed upstream. Track the resolution and patched release through GitHub Issue #6613 and the Assimp GitHub Repository. Rebuild and redistribute any downstream application that statically links Assimp after upgrading.

Workarounds

Disable or avoid the FBX export code path in environments where untrusted scene data may be processed.
Run Assimp-dependent conversion jobs in isolated, restartable worker processes so that a divide-by-zero crash does not affect the parent service.
Wrap calls to FBXExporter::WriteObjects with structured exception handling to convert arithmetic faults into recoverable errors.

bash

# Example: pin and verify Assimp version in a build pipeline
git -C third_party/assimp fetch --tags
git -C third_party/assimp checkout <patched-tag>
cmake -S third_party/assimp -B build/assimp -DASSIMP_BUILD_FBX_EXPORTER=OFF
cmake --build build/assimp --config Release