Assimp CVE-2026-10198

Local execution is required - the attack vector is AV:L, meaning the attacker must have the ability to execute code or supply files on the host system. Low privileges suffice (PR:L); no administrative or elevated rights are needed. The vulnerable code path is triggered only when an application invokes Assimp's glTF importer to process a crafted glTF mesh file, so the application must accept user-controlled or externally sourced .gltf or .glb files. No user interaction beyond the attacker's own actions is required (UI:N). Exploitation is limited by the local-only attack surface - remote unauthenticated exploitation is not possible. Impact is strictly a denial of service (process crash); no code execution, data exfiltration, or privilege escalation is achievable via this vulnerability. Applications that only load internally generated or trusted glTF assets are not realistically at risk.

The real-world risk is low. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L confirms local-only access is required, low privileges suffice, but impact is limited strictly to partial availability (application crash) with zero confidentiality or integrity consequences. The exploit maturity modifier E:P confirms a proof-of-concept exists, and RC:R (Reasonable Confidence) indicates the vulnerability is not yet fully corroborated. No EPSS score was provided in the source data, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, meaning no confirmed in-the-wild exploitation is on record. Critically, the Assimp project itself tagged the submitted report as a 'bug' rather than a security issue, which suggests the vendor may deprioritize a dedicated security fix. For applications that process only trusted glTF files in controlled environments, this poses negligible risk. Applications that accept user-supplied or externally sourced 3D model files face a denial-of-service surface worth mitigating, particularly in long-running server processes.

A local user with standard (low-privilege) account access supplies a specially crafted .gltf file to an application that uses Assimp ≤6.0.4 for 3D model loading - for example, a content creation tool, game engine editor, or model viewer. When the application attempts to import the file, the call to Assimp::glTFImporter::ImportMeshes dereferences a null pointer, immediately crashing the host process. A proof-of-concept archive (poc.zip) is publicly available at https://github.com/user-attachments/files/27193865/poc.zip, lowering the technical bar for reproducing the crash.