CVE-2026-10197

EUVD-2026-33519 · Published May 31, 2026

A vulnerability was detected in Assimp up to 6.0.4. Affected is the function glTF2Importer::ImportEmbeddedTextures in the library code/AssetLib/glTF2/glTF2Importer.cpp of the component TF File Handler. The manipulation results in null pointer dereference. The attack is only possible with local access. The exploit is now public and may be used. It is advisable to implement a patch to correct this issue. The pull request to fix this issue awaits acceptance.

Weaknesses

CWE-404CWE-476

CVSS scores

v4.01.9CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
v3.13.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
v2.01.7AV:L/AC:L/Au:S/C:N/I:N/A:P

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Privilege Escalation Impact

T1068Exploitation for Privilege Escalation T1498.001Direct Network Flood T1499Endpoint Denial of Service T1499.001OS Exhaustion Flood T1499.003Application Exhaustion Flood

References

Potentially impacted assets

See if this affects your attack surface