CVE-2026-111128 Details
Description
Assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D importer that allows attackers to crash applications via unvalidated bone indices in OgreStructs.cpp. Attackers can supply a crafted .mesh and .skeleton file referencing a missing bone, causing BoneById() to return null and crash the host process.
A NULL pointer dereference vulnerability has been identified in the Open Asset Import Library (assimp) versions through 6.0.5. This vulnerability resides within the Ogre3D importer, specifically in the file 'OgreStructs.cpp'. The issue allows attackers to crash applications by exploiting unvalidated bone indices. When a crafted .mesh file is imported, it can reference a non-existent bone, causing the application to dereference a NULL pointer and crash the process.
The vulnerability can be fixed by adding NULL checks for bone indices and animation track targets before dereferencing them. This can be done in the 'OgreStructs.cpp' file, specifically in the 'SubMesh::ConvertToAssimpMesh' and 'Animation::AssociatedVertexData' functions.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Assimp | <= 6.0.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |