EUVD-2026-33520
GHSA-7m2c-m24q-64cc
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A flaw has been found in Assimp up to 6.0.4. Affected by this vulnerability is the function Assimp::glTFImporter::ImportMeshes of the file glTFImporter.cpp of the component glTFImporter. This manipulation causes null pointer dereference. The attack is restricted to local execution. The exploit has been published and may be used. The project tagged the reported issue as bug.
AnalysisAI
Null pointer dereference in Assimp's glTF mesh importer (versions up to and including 6.0.4) allows a locally authenticated attacker with low privileges to crash any application that uses the library to process a crafted 3D model file. The flaw resides specifically in the Assimp::glTFImporter::ImportMeshes function within glTFImporter.cpp, meaning only applications that invoke the glTF import pipeline are exposed. A publicly available proof-of-concept exploit (poc.zip) has been released, though no active exploitation has been confirmed and the CVSS score of 3.3 (Low) reflects the constrained local-only, availability-only impact.
Technical ContextAI
Assimp (Open Asset Import Library) is a widely-used open-source C++ library for loading and processing dozens of 3D model file formats, commonly embedded in game engines, 3D tools, and rendering applications. The affected component is the glTF (GL Transmission Format) importer, which parses mesh data from .gltf/.glb files. CWE-476 (NULL Pointer Dereference) indicates that during mesh import, the function Assimp::glTFImporter::ImportMeshes in glTFImporter.cpp dereferences a pointer that has not been validated for null before use - typically triggered by a malformed or adversarially crafted glTF file that violates parser assumptions. The CPE string cpe:2.3:a:n/a:assimp:*:*:*:*:*:*:*:* covers all versions and platforms, indicating the NVD has not yet assigned a vendor identifier, which is consistent with this being reported primarily through VulDB (entry 367478) and an open GitHub issue (#6609) rather than a formal vendor security advisory.
RemediationAI
No vendor-released patched version has been identified at time of analysis - the Assimp project tagged GitHub issue #6609 as a bug, and no fix commit or tagged release resolving this null dereference has been confirmed from available references. Upstream fix availability should be monitored at https://github.com/assimp/assimp/. As a compensating control, applications that process externally supplied 3D model files should validate and sanitize glTF input before passing it to Assimp, or restrict glTF loading to trusted, internal sources only; this eliminates the attacker-controlled input prerequisite. Where possible, execute Assimp-dependent processing in a sandboxed subprocess or container so a crash does not terminate the parent application or service. Disabling glTF import support at compile time (if the application does not require .gltf/.glb handling) removes the vulnerable code path entirely, with the trade-off of losing glTF format support. Watch the Assimp releases page for a fix version and upgrade promptly once available.
An issue in assimp v.5.4.3 allows a local attacker to execute arbitrary code via the CallbackToLogRedirector function wi
Open Asset Import Library (assimp) commit 3c253ca was discovered to contain a segmentation violation via the component A
A heap-buffer-overflow vulnerability was discovered in the SkipSpacesAndLineEnd function in Assimp v5.4.3. Rated medium
A segmentation fault (SEGV) was detected in the SortByPTypeProcess::Execute function in the Assimp library during fuzz t
A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode function within the
A heap-buffer-overflow vulnerability has been identified in the OpenDDLParser::parseStructure function within the Assimp
A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. Rated medium severity (CV
A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic.h of the component CSM
A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. Rated medium severity (
A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3.cpp. Rated m
A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. Rated medium severity (CVSS
A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. Rated medium severity (
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Null Pointer Dereference
View allShare
External POC / Exploit Code
Leaving vuln.today