The vulnerability exists in Assimp’s glTF2Asset.h LazyDict function. Manipulating the argument operator[] can lead to a null pointer dereference, causing the application that loads the glTF file to crash. This results in a denial‑of‑service condition for processes that ingest the malicious file. The flaw is associated with CWE‑404 (Improper Resource Management) and CWE‑476 (Null Pointer Dereference). It does not grant remote code execution or compromise memory contents beyond the crash.

All users of the Assimp library up to and including version 6.0.4 are impacted. The library is embedded in numerous 3D and game engines, media players, and other graphics tools (inferred). Any instance of Assimp that processes a crafted glTF file will be susceptible. The patch reference is commit d24b85319bd70c65883a2b96613e07e23fb95981.

The CVSS base score of 4.8 classifies the flaw as moderate. EPSS is unavailable, and the vulnerability is not listed in the CISA KEV catalog, indicating limited public exploitation. The attack vector is local: an attacker must supply a malicious glTF file to the target application. The required conditions are simple and low complexity, but the impact remains confined to a local denial of service.