CVE-2026-10200: Assimp 4x4 Matrix glTFCommon.h CopyValue heap-based overflow
A vulnerability was found in Assimp up to 6.0.4. This affects the function glTFCommon::CopyValue in the library glTFCommon.h of the component 4x4 Matrix Parser. Performing a manipulation results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been made public and could be used. The project tagged the reported issue as bug.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Assimpfrom your environment.If Assimp is not required, uninstall or remove the library/binaries from affected hosts (versions up to 6.0.4) until a patch is released.
- Compensating control
Restrict local access to systems running Assimp. Prevent untrusted local users or processes from supplying or processing glTF files (use host-based controls, sandboxing, ACLs, or similar measures) because the attack must be initiated from a local position.
- Operational
Do not process untrusted glTF files with vulnerable Assimp versions (any version up to 6.0.4) until a vendor fix is available.
- Operational
Monitor for exploitation attempts and signs of compromise related to glTF processing (the exploit has been made public). Investigate and isolate suspicious hosts and prioritize applying vendor fixes when they are released.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10200?
The severity of CVE-2026-10200 is classified as low with a severity score of 1.9.
How do I fix CVE-2026-10200?
To mitigate CVE-2026-10200, update to Assimp version 6.0.5 or later, where the vulnerability has been addressed.
What type of vulnerability is CVE-2026-10200?
CVE-2026-10200 is a buffer overflow vulnerability specifically affecting the 4x4 Matrix Parser in Assimp.
What are the potential impacts of CVE-2026-10200 if exploited?
If exploited, CVE-2026-10200 could lead to a heap-based buffer overflow, potentially allowing an attacker to execute arbitrary code.
Which component of Assimp is affected by CVE-2026-10200?
CVE-2026-10200 affects the function glTFCommon::CopyValue in the glTFCommon.h component of Assimp.