CVE-2026-10199: Assimp glTF2Asset.h LazyDict null pointer dereference
A vulnerability has been found in Assimp up to 6.0.4. Affected by this issue is the function glTF2::LazyDict in the library glTF2Asset.h. Such manipulation of the argument operator[] leads to null pointer dereference. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The name of the patch is d24b85319bd70c65883a2b96613e07e23fb95981. It is best practice to apply a patch to resolve this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
assimpto a version that resolves this vulnerability.Fixed in 6.0.4Patch d24b85319bd70c65883a2b96613e07e23fb95981
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10199?
CVE-2026-10199 has a severity rating of low with a score of 3.3.
How does CVE-2026-10199 affect Assimp?
CVE-2026-10199 affects the function glTF2::LazyDict in the library glTF2Asset.h, leading to a null pointer dereference.
What can an attacker do with CVE-2026-10199?
An attacker can exploit CVE-2026-10199 by manipulating the argument operator[] to trigger a null pointer dereference.
Is CVE-2026-10199 a local or remote vulnerability?
CVE-2026-10199 is a local vulnerability, meaning the attack must be carried out locally.
How can users protect themselves from CVE-2026-10199?
Users can protect themselves from CVE-2026-10199 by updating to a patched version of Assimp beyond 6.0.4.