CVE-2026-10199
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A vulnerability in Assimp up to version 6.0.4 affects the glTF2::LazyDict function in glTF2Asset.h, leading to a null pointer dereference via the operator[] argument. Local access is required, and the exploit is public.
Risk Assessment
A local attacker could crash the application (denial of service) by triggering a null pointer dereference.
Recommendation
Apply the patch d24b85319bd70c65883a2b96613e07e23fb95981 to resolve the issue.
Original NVD description (English source)
A vulnerability has been found in Assimp up to 6.0.4. Affected by this issue is the function glTF2::LazyDict in the library glTF2Asset.h. Such manipulation of the argument operator[] leads to null pointer dereference. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The name of the patch is d24b85319bd70c65883a2b96613e07e23fb95981. It is best practice to apply a patch to resolve this issue.