DEBIAN-CVE-2026-10198
A flaw has been found in Assimp up to 6.0.4. Affected by this vulnerability is the function Assimp::glTFImporter::ImportMeshes of the file glTFImporter.cpp of the component glTFImporter. This manipulation causes null pointer dereference. The attack is restricted to local execution. The exploit has been published and may be used. The project tagged the reported issue as bug.
DEBIAN-CVE-2026-10198
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-10198
assimp
Source reference: /affected/0/package/name
- Affected versions
- 5.2.5~ds0-1
Source reference:
/affected/0/versions5.2.5~ds0-1.1Source reference:
/affected/0/versions5.3.1+ds-1Source reference:
/affected/0/versions5.3.1+ds-2Source reference:
/affected/0/versions5.4.0+ds-1Source reference:
/affected/0/versions5.4.1+ds-1Source reference:
/affected/0/versions5.4.2+ds-1Source reference:
/affected/0/versions5.4.3+ds-2Source reference:
/affected/0/versions5.4.3+ds-3Source reference:
/affected/0/versions6.0.2+ds-1Source reference:
/affected/0/versions6.0.3+ds-1Source reference:
/affected/0/versions6.0.4+ds-1Source reference:
/affected/0/versions6.0.4+ds-3Source reference:
/affected/0/versions6.0.5+ds-1Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
assimp
Source reference: /affected/1/package/name
- Affected versions
- 5.4.3+ds-2
Source reference:
/affected/1/versions5.4.3+ds-3Source reference:
/affected/1/versions6.0.2+ds-1Source reference:
/affected/1/versions6.0.3+ds-1Source reference:
/affected/1/versions6.0.4+ds-1Source reference:
/affected/1/versions6.0.4+ds-3Source reference:
/affected/1/versions6.0.5+ds-1Source reference:
/affected/1/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
assimp
Source reference: /affected/2/package/name
- Affected versions
- 5.4.3+ds-2
Source reference:
/affected/2/versions5.4.3+ds-3Source reference:
/affected/2/versions6.0.2+ds-1Source reference:
/affected/2/versions6.0.3+ds-1Source reference:
/affected/2/versions6.0.4+ds-1Source reference:
/affected/2/versions6.0.4+ds-3Source reference:
/affected/2/versions6.0.5+ds-1Source reference:
/affected/2/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "assimp",
"purl": "pkg:deb/debian/assimp?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"5.2.5~ds0-1",
"5.2.5~ds0-1.1",
"5.3.1+ds-1",
"5.3.1+ds-2",
"5.4.0+ds-1",
"5.4.1+ds-1",
"5.4.2+ds-1",
"5.4.3+ds-2",
"5.4.3+ds-3",
"6.0.2+ds-1",
"6.0.3+ds-1",
"6.0.4+ds-1",
"6.0.4+ds-3",
"6.0.5+ds-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-10198.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "assimp",
"purl": "pkg:deb/debian/assimp?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"5.4.3+ds-2",
"5.4.3+ds-3",
"6.0.2+ds-1",
"6.0.3+ds-1",
"6.0.4+ds-1",
"6.0.4+ds-3",
"6.0.5+ds-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-10198.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "assimp",
"purl": "pkg:deb/debian/assimp?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"5.4.3+ds-2",
"5.4.3+ds-3",
"6.0.2+ds-1",
"6.0.3+ds-1",
"6.0.4+ds-1",
"6.0.4+ds-3",
"6.0.5+ds-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-10198.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #55425 · Revision 1
- Added to Heist Feed
- Publisher date