Is there a public PoC exploit available for CVE-2026-10201?

Yes, a public proof-of-concept exploit is available for CVE-2026-10201. Prioritise patching immediately. EPSS: 0.0%.

Assimp CVE-2026-10201

Q: What is the CVSS score of CVE-2026-10201?

CVE-2026-10201 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33523 LOW

Divide By Zero (CWE-369)

2026-06-01 cna@vuldb.com

GHSA-6jj7-xf98-rxhg

Information Disclosure

1.9

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

1.9 LOW

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (vuldb) · only source for this CVE.

CVSS VectorVendor: vuldb

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 00:27 vuln.today

DescriptionCVE.org

A vulnerability was determined in Assimp up to 6.0.4. This vulnerability affects the function FBXExporter::WriteObjects of the file FBXExporter.cpp of the component UV Channel Handler. Executing a manipulation can lead to divide by zero. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Applying a patch is advised to resolve this issue. The project tagged the reported issue as bug.

AnalysisAI

Divide-by-zero in Assimp's FBXExporter (UV Channel Handler) up to version 6.0.4 crashes the application when processing maliciously crafted UV channel data during FBX export, resulting in a local denial-of-service condition. An authenticated local user with low privileges can trigger the crash by supplying crafted input to the FBXExporter::WriteObjects function in FBXExporter.cpp. Publicly available exploit code exists via a POC ZIP hosted on GitHub; no active exploitation is confirmed (not in CISA KEV), and the CVSS 4.0 score of 1.9 reflects the severely constrained real-world impact.

Technical ContextAI

Assimp (Open Asset Import Library) is a widely used open-source C++ library for importing and exporting 3D model file formats, commonly embedded in game engines, 3D editors, and content processing pipelines. The vulnerability resides in FBXExporter.cpp within the UV Channel Handler, specifically in the WriteObjects function responsible for serializing UV mapping data during FBX export. CWE-369 (Divide By Zero) identifies the root cause as a missing or insufficient check on a divisor value - a UV channel count, index, or dimension used as a denominator is not validated against zero before the division operation occurs, triggering an unhandled exception or crash. This class of bug is common in geometry/mesh processing code where array sizes or channel counts are assumed to be non-zero but are not explicitly guarded.

RemediationAI

The Assimp project has been advised to apply a patch per the CVE description, but a specific patched release version is not confirmed in the available data - upstream fix available (PR/commit via GitHub issue #6613); released patched version not independently confirmed. Consumers should monitor the official repository at https://github.com/assimp/assimp/ for a tagged release addressing issue #6613 and upgrade as soon as one is available. As an immediate compensating control, applications that process untrusted files should restrict input to formats other than FBX, or validate UV channel counts and indices before invoking the FBX export path - this eliminates the vulnerable code path without affecting other format support. In environments where FBX export is not required, disabling or removing the FBXExporter compilation unit entirely removes the attack surface with no functional trade-off.