NULL Pointer Dereference in Assimp Ogre3D Importer
CVE-2026-111128

6.8MEDIUM

Key Information:

Vendor

Assimp

Status
Assimp
Vendor
CVE Published:
15 October 2026

What is CVE-2026-111128?

The vulnerability in Assimp, through version 6.0.5, involves a NULL pointer dereference found in the Ogre3D importer. This occurs when attackers craft .mesh and .skeleton files that reference non-existent bone indices, leading to a crash of the host application. The BoneById() function fails to handle these missing references properly, resulting in a system vulnerability that could be exploited to disrupt services.

Affected Version(s)

assimp 0 <= 6.0.5

References

https://hackmd.io/@haind-pwn/assimp-ogre-mesh-bone-submes...
technical-description
https://github.com/assimp/assimp/blob/392a658f9c271be9652...
technical-description
https://github.com/assimp/assimp/blob/392a658f9c271be9652...
technical-description

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.