Description
A vulnerability has been found in Assimp up to 6.0.4. Affected by this issue is the function glTF2::LazyDict in the library glTF2Asset.h. Such manipulation of the argument operator[] leads to null pointer dereference. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The name of the patch is d24b85319bd70c65883a2b96613e07e23fb95981. It is best practice to apply a patch to resolve this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Assimp | 6.0.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | assimp | No fix yet | — |
| Debian 13 | assimp | No fix yet | — |
| Debian 12 | assimp | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | assimp | No fix yet | — |
| Ubuntu 26.04 LTS | assimp | No fix yet | — |
| Ubuntu 25.10 | assimp | No fix yet | — |
| Ubuntu 24.04 LTS | assimp | No fix yet | — |
| Ubuntu 22.04 LTS | assimp | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | assimp | No fix yet | — |
| Ubuntu 18.04 LTS | assimp | No fix yet | — |
| Ubuntu 16.04 LTS | assimp | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | assimp | 6.0.5-3.1 | openSUSE-SU-2026:10946-1 |
| openSUSE Leap 16.0 | assimp | 5.4.3-160000.4.1 | openSUSE-SU-2026:21242-1 |
Advisories 2
- openSUSE-SU-2026:21242-1 Security update for assimp SUSE / openSUSE Security Updates · Jul 9, 2026
- openSUSE-SU-2026:10946-1 assimp-devel-6.0.5-3.1 on GA media SUSE / openSUSE Security Updates · Jun 4, 2026
References
- VDB-367479 | Assimp glTF2Asset.h LazyDict null pointer dereference vdb-entry technical-description
- VDB-367479 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-10199 | CVE Analysis and Report third-party-advisory
- Submit #821179 | Assimp commit 17c12da NULL Pointer Dereference third-party-advisory
- https://github.com/assimp/assimp/issues/6611 issue-tracking
- https://github.com/assimp/assimp/pull/6646 issue-tracking patch
- https://github.com/user-attachments/files/27194148/poc.zip exploit
- https://github.com/assimp/assimp/commit/d24b85319bd70c65883a2b96613e07e23fb95981 patch
- https://github.com/assimp/assimp/ product