CVE-2026-10199

A vulnerability has been found in Assimp up to 6.0.4. Affected by this issue is the function glTF2::LazyDict in the library glTF2Asset.h. Such manipulation of the argument operator[] leads to null pointer dereference. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The name of the patch is d24b85319bd70c65883a2b96613e07e23fb95981. It is best practice to apply a patch to resolve this issue.

CVSS v3 3.3 LOW
CVSS v2.0 1.7 LOW

3.3^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

1.7^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:S/C:N/I:N/A:P

Exploitability : 3.1 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://github.com/assimp/assimp/
https://github.com/assimp/assimp/commit/d24b85319bd70c65883a2b96613e07e23fb95981
https://github.com/assimp/assimp/issues/6611
https://github.com/assimp/assimp/pull/6646
https://github.com/user-attachments/files/27194148/poc.zip
https://vuldb.com/cve/CVE-2026-10199
https://vuldb.com/submit/821179
https://vuldb.com/vuln/367479
https://vuldb.com/vuln/367479/cti

Configurations

No configuration.

History

22 Jul 2026, 07:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad ha sido encontrada en Assimp hasta la versión 6.0.4. Afectada por este problema es la función glTF2::LazyDict en la biblioteca glTF2Asset.h. Dicha manipulación del argumento operator[] lleva a una desreferencia de puntero nulo. El ataque debe ser llevado a cabo localmente. El exploit ha sido divulgado al público y puede ser utilizado. El nombre del parche es d24b85319bd70c65883a2b96613e07e23fb95981. Es una buena práctica aplicar un parche para resolver este problema.

31 May 2026, 23:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-05-31 23:16

Updated : 2026-07-22 07:10

NVD link : CVE-2026-10199

Mitre link : CVE-2026-10199

CVE.ORG link : CVE-2026-10199

JSON object : View

Products Affected

No product.

CWE

CWE-404

Improper Resource Shutdown or Release

CWE-476

NULL Pointer Dereference

{"id": "CVE-2026-10199", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10199", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-01T15:15:05.264879Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 1.7, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:S/C:N/I:N/A:P", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.1, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 1.9, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:assimp:assimp:*:*:*:*:*:*:*:*"], "vendor": "n/a", "product": "Assimp", "versions": [{"status": "affected", "version": "6.0.0"}, {"status": "affected", "version": "6.0.1"}, {"status": "affected", "version": "6.0.2"}, {"status": "affected", "version": "6.0.3"}, {"status": "affected", "version": "6.0.4"}]}]}], "published": "2026-05-31T23:16:42.413", "references": [{"url": "https://github.com/assimp/assimp/", "source": "cna@vuldb.com"}, {"url": "https://github.com/assimp/assimp/commit/d24b85319bd70c65883a2b96613e07e23fb95981", "source": "cna@vuldb.com"}, {"url": "https://github.com/assimp/assimp/issues/6611", "source": "cna@vuldb.com"}, {"url": "https://github.com/assimp/assimp/pull/6646", "source": "cna@vuldb.com"}, {"url": "https://github.com/user-attachments/files/27194148/poc.zip", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/cve/CVE-2026-10199", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/821179", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/367479", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/367479/cti", "source": "cna@vuldb.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-404"}, {"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in Assimp up to 6.0.4. Affected by this issue is the function glTF2::LazyDict in the library glTF2Asset.h. Such manipulation of the argument operator[] leads to null pointer dereference. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The name of the patch is d24b85319bd70c65883a2b96613e07e23fb95981. It is best practice to apply a patch to resolve this issue."}, {"lang": "es", "value": "Una vulnerabilidad ha sido encontrada en Assimp hasta la versi\u00f3n 6.0.4. Afectada por este problema es la funci\u00f3n glTF2::LazyDict en la biblioteca glTF2Asset.h. Dicha manipulaci\u00f3n del argumento operator[] lleva a una desreferencia de puntero nulo. El ataque debe ser llevado a cabo localmente. El exploit ha sido divulgado al p\u00fablico y puede ser utilizado. El nombre del parche es d24b85319bd70c65883a2b96613e07e23fb95981. Es una buena pr\u00e1ctica aplicar un parche para resolver este problema."}], "lastModified": "2026-07-22T07:10:00.107", "sourceIdentifier": "cna@vuldb.com"}