Description
Assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D importer that allows attackers to crash applications via unvalidated bone indices in OgreStructs.cpp. Attackers can supply a crafted .mesh and .skeleton file referencing a missing bone, causing BoneById() to return null and crash the host process.
Published: 2026-10-15
Score: 6.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

Assimp through version 6.0.5 has a NULL pointer dereference in the Ogre3D importer caused by unvalidated bone indices referenced in .mesh and .skeleton files. When an attacker supplies a crafted file containing a missing bone, the function BoneById() returns null and the host process crashes. This flaw results in a denial of service rather than disclosure of data or arbitrary code execution.

Affected Systems

The vulnerability affects the Assimp library, vendor "assimp", in all releases up to and including 6.0.5. Any application that uses Assimp to import Ogre3D mesh files without verifying bone references is potentially exposed.

Risk and Exploitability

The CVSS score of 6.8 indicates a moderate level of severity, while the EPSS score of < 1% suggests limited likelihood of exploitation in the near term. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires crafting or obtaining a malicious .mesh or .skeleton file, so the attack vector is local or remote file ingestion depending on how the application accepts input.

Generated by OpenCVE AI on October 16, 2026 at 16:46 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Assimp to version 6.0.6 or later where the bug is fixed.
  • If an upgrade is not possible, disable or remove use of the Ogre3D importer for untrusted input.
  • Validate incoming .mesh and .skeleton files to ensure referenced bones exist before processing.
  • Monitor application logs for unexpected crashes and block further processing of suspicious files.

Generated by OpenCVE AI on October 16, 2026 at 16:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 15 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description Assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D importer that allows attackers to crash applications via unvalidated bone indices in OgreStructs.cpp. Attackers can supply a crafted .mesh and .skeleton file referencing a missing bone, causing BoneById() to return null and crash the host process.
Title Assimp through 6.0.5 NULL Pointer Dereference via Ogre Importer Bone Assignment
First Time appeared Assimp
Assimp assimp
Weaknesses CWE-476
CPEs cpe:2.3:a:assimp:assimp:*:*:*:*:*:*:*:*
Vendors & Products Assimp
Assimp assimp
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 6.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Assimp Assimp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-15T19:45:45.607Z

Reserved: 2026-10-15T17:03:52.218Z

Link: CVE-2026-111128

cve-icon Vulnrichment

Updated: 2026-10-15T19:45:41.640Z

cve-icon NVD

Status : Deferred

Published: 2026-10-15T19:17:26.213

Modified: 2026-10-16T18:25:45.343

Link: CVE-2026-111128

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-15T18:57:24Z

Links: CVE-2026-111128 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T13:30:08Z

Weaknesses