EUVD-2026-33519
GHSA-2r76-r3fx-jwv2
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (vuldb) · only source for this CVE.
CVSS VectorVendor: vuldb
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was detected in Assimp up to 6.0.4. Affected is the function glTF2Importer::ImportEmbeddedTextures in the library code/AssetLib/glTF2/glTF2Importer.cpp of the component TF File Handler. The manipulation results in null pointer dereference. The attack is only possible with local access. The exploit is now public and may be used. It is advisable to implement a patch to correct this issue. The pull request to fix this issue awaits acceptance.
AnalysisAI
Null pointer dereference in Assimp's glTF2 importer (versions up to 6.0.4) allows a local attacker to crash any application embedding the library by supplying a malformed glTF2 asset. The vulnerable function ImportEmbeddedTextures performs pointer arithmetic on the return value of strchr() before checking for null, meaning a glTF2 embedded texture with a MIME type lacking a '/' character triggers undefined behavior and a process crash. A public POC is available; no active exploitation has been confirmed by CISA KEV. CVSS 4.0 scores this at 1.9, reflecting the local-only, availability-only impact.
Technical ContextAI
Assimp (Open Asset Import Library) is a widely used open-source C++ library for importing and processing 3D model formats across game engines, media tools, and asset pipelines. The flaw is in glTF2Importer::ImportEmbeddedTextures within code/AssetLib/glTF2/glTF2Importer.cpp. The original code executes const char *ext = strchr(img.mimeType.c_str(), '/') + 1 unconditionally - when strchr() finds no '/' character, it returns nullptr, and adding 1 to that null pointer constitutes undefined behavior (a null pointer dereference in practice) before the subsequent if (ext) null check can fire. The PR fix correctly saves the strchr result as slash, checks slash != nullptr first, and only then computes ext = slash + 1. The assigned CWE-404 (Improper Resource Shutdown or Release) appears to reflect the DoS impact rather than the precise coding defect; CWE-476 (NULL Pointer Dereference) would be more technically precise for the root cause.
RemediationAI
No vendor-released patched version is confirmed at time of analysis. An upstream fix exists as a pending pull request at https://github.com/assimp/assimp/pull/6645, but it has not yet been merged or tagged as a release. Organizations should monitor the Assimp GitHub repository and release notes for a patched version and upgrade as soon as one is published. As an immediate compensating control, applications using Assimp should restrict glTF2 asset ingestion to fully trusted sources and reject files from untrusted or user-controlled inputs. Where feasible, add an application-layer pre-validation step that confirms all embedded texture mimeType fields contain a '/' character before passing assets to Assimp; this removes the specific trigger condition with no functional trade-off for well-formed files. Pipelines that cannot restrict input sources should consider sandboxing the Assimp loading process so a crash does not propagate to the broader application.
Same weakness CWE-404 – Improper Resource Shutdown or Release
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today