A null pointer dereference has been identified in the ImportMeshes function of the glTFImporter component of Assimp. When an untrusted glTF file is processed, the code can dereference a null pointer, causing the application to crash or terminate prematurely. The flaw falls under CWE‑476 and may also be considered a CWE‑404 issue involving improper resource release. The primary consequence is a denial‑of‑service for local users; no data is disclosed or privileges elevated.

The vulnerability exists in all Assimp releases up to and including version 6.0.4. Systems that embed this library and import user‑supplied glTF assets—such as game engines, 3‑D content pipelines, CAD viewers, and multimedia players—are potentially affected.

The CVSS score of 4.8 reflects moderate severity, limited to local execution. No EPSS data are available, but publicly available proof‑of‑concept code demonstrates that an attacker can easily supply a crafted glTF file to trigger the crash. Although the exploit does not provide remote code execution or privilege escalation, it can be used to repeatedly deny service by crashing the importing process. The vulnerability is listed as not included in CISA KEV, implying no known widespread exploitation at this time.