Assimp CVE-2026-10201

Exploitation requires local system access with at minimum low-privileged credentials, as confirmed by the CVSS 4.0 vector (AV:L/PR:L). The vulnerability is specific to Assimp's FBX export code path - the FBXExporter::WriteObjects function within the UV Channel Handler must be invoked with crafted UV channel data. Systems and applications that never exercise Assimp's FBX export functionality (e.g., import-only deployments) are not exposed. No network-based exploitation is possible given AV:L. No user interaction is required beyond the attacker's ability to supply input to an Assimp-based application's export function. Exploitation is further limited by the low impact ceiling: the outcome is an application crash (VA:L), with no confidentiality or integrity impact possible per the CVSS vector.

The CVSS 4.0 base score of 1.9 accurately reflects the narrow real-world risk: AV:L (local-only attack, no network exposure), PR:L (low-privileged access required), VA:L (availability impact limited to the vulnerable component), and VC:N/VI:N (no confidentiality or integrity impact). The E:P supplemental metric confirms a publicly available proof-of-concept, which is the most notable risk amplifier. No EPSS score was provided in the available data. This CVE is not listed in CISA's KEV catalog, confirming no observed active exploitation in the wild. The practical threat is limited to content processing pipelines that accept untrusted FBX files from local or semi-trusted users - game engine editors, 3D asset pipelines, or developer toolchains. A crash is the worst-case outcome; no code execution path is implied by the CVSS impact metrics. The intelligence source tags this as 'Information Disclosure,' which directly conflicts with the CVSS vector showing VC:N (no confidentiality impact) and VA:L (availability only) - the CVSS vector is treated as authoritative, and the tag appears to be a mis-classification.

A local attacker with low-privileged access to a workstation or build server running an Assimp-based 3D asset pipeline crafts a malicious FBX file containing a UV channel configuration with a zero-value denominator and submits it for export processing. When FBXExporter::WriteObjects processes the UV channel data, the unguarded division by zero occurs, crashing the host application and denying service to legitimate users or automated pipeline jobs. A publicly available POC demonstrating this crash is accessible at https://github.com/user-attachments/files/27153727/poc.zip.