assimp EUVD-2026-102360

Requires an application that uses assimp's Ogre3D binary mesh importer and that parses an attacker-supplied .mesh file; the file must contain a morph animation track whose target references a missing submesh or an absent shared-geometry definition, triggering the unvalidated-target NULL dereference in OgreBinarySerializer::ReadAnimationKeyFrames(). Exploitation is LIMITED by: the local attack vector (the file must reach the victim's system/application), required passive user interaction (UI:P - the victim must open or import the malicious model), and the impact ceiling - the result is a process crash only, with no code execution, memory disclosure, or integrity impact. No special non-default configuration is needed beyond use of the Ogre importer, which is a standard assimp format handler.

This is a moderate-severity, availability-only defect. The vendor (VulnCheck) CVSS 4.0 vector CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H scores 6.8 and is internally consistent with the description: a NULL pointer dereference (CWE-476) that crashes the host process, with no confidentiality or integrity impact (VC:N/VI:N) and only high availability impact (VA:H). The local attack vector (AV:L) plus passive user interaction (UI:P) means an attacker cannot reach this remotely on their own - a victim must feed a crafted .mesh file into an application that uses assimp's Ogre importer. No EPSS score, CISA KEV listing, or SSVC decision point was supplied in the input, so there is no signal of active exploitation or automatability; absence of these is not evidence either way. A detailed third-party technical writeup (hackmd) and exact vulnerable source lines are referenced, which lowers the barrier to reproducing a crash, but no exploit-code flag was provided in the input. Net: this is a real but low-priority DoS bug, not a critical widespread threat - it cannot achieve code execution or data compromise, and exploitation is user-interaction-gated and local in nature. Note a mild tension: file-parsing crashes are sometimes scored AV:N when the file arrives over a network, but the vendor chose AV:L - verify delivery model for your deployment.

An attacker crafts a malicious Ogre3D binary .mesh file containing a morph animation track that targets a missing submesh or absent shared geometry, then delivers it to a victim (e.g., as a downloadable 3D asset or via an application that auto-imports untrusted models). When the victim's application parses the file through assimp's OgreBinarySerializer, ReadAnimationKeyFrames() dereferences a NULL target and crashes the host process. A technical writeup describing the flaw is publicly referenced, but no weaponized exploit-code flag was provided in the input.