CVE-2026-111129: Assimp through 6.0.5 NULL Pointer Dereference via Ogre Animation Track
Open Asset Import Library (assimp) through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D binary mesh importer's OgreBinarySerializer::ReadAnimationKeyFrames() handling of unvalidated animation track targets. Attackers can supply a crafted .mesh file with a morph animation track targeting a missing submesh or absent shared geometry to crash the host process.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications that use Assimp through 6.0.5 to import Ogre3D binary .mesh files are exposed when they process attacker-controlled or otherwise untrusted mesh files.
What does an attacker need to do to trigger the vulnerability?
An attacker needs to persuade a user or application to import a crafted .mesh file. The file must contain a morph animation track that targets a missing submesh or lacks shared geometry.
What is the impact of successful exploitation?
Successful exploitation causes a NULL pointer dereference in the Ogre3D binary mesh importer, crashing the host process. The provided data indicates an availability impact only, with no confidentiality or integrity impact.