NULL Pointer Dereference in Open Asset Import Library's Ogre3D Mesh Importer
CVE-2026-111129

6.8MEDIUM

Key Information:

Vendor

Assimp

Status
Assimp
Vendor
CVE Published:
15 October 2026

What is CVE-2026-111129?

The Open Asset Import Library version up to 6.0.5 contains a vulnerability in its Ogre3D binary mesh importer that may lead to a NULL pointer dereference. This occurs specifically within the ReadAnimationKeyFrames() function, where unvalidated animation track targets are handled. Attackers could exploit this flaw by supplying specially crafted .mesh files that contain morph animation tracks targeting missing submeshes or absent shared geometry, which can crash the host process and potentially disrupt operations.

Affected Version(s)

assimp 0 <= 6.0.5

References

https://hackmd.io/@haind-pwn/assimp-ogre-mesh-bone-submes...
technical-description
https://github.com/assimp/assimp/blob/392a658f9c271be9652...
technical-description
https://github.com/assimp/assimp/blob/392a658f9c271be9652...
technical-description

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.