CVE-2026-10199

Executive Summary

CVE-2026-10199 is a locally exploitable null pointer dereference vulnerability in the Assimp library, specifically within the glTF2::LazyDict function in glTF2Asset.h. The vulnerability is triggered by manipulating the operator[] argument, leading to a null pointer dereference. The CVSS score is 3.3 (Low), indicating low severity due to the requirement for local access and the limited impact (availability only). The exploit has been publicly disclosed, and a patch is available in the Assimp repository. The EPSS score is 0.0%, suggesting very low exploitation activity in the wild.

Supply Chain & Package Security

Assimp is a widely used library for importing various 3D model formats. It is a dependency in many applications, including game engines, 3D modeling tools, and rendering software. This vulnerability could affect any application that uses the vulnerable version of Assimp to load glTF2 files. The attack is local, meaning an attacker must have local access to the system to exploit it. However, in supply chain scenarios, a malicious glTF2 file could be delivered to a user, and when the user opens it with an application using the vulnerable Assimp, the null pointer dereference could cause a denial of service (application crash).

CVSS Breakdown & Threat Level

• CVSS Score: 3.3 (Low)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
• Attack Vector (AV): Local (L) - The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) - The attack does not require special conditions.
• Privileges Required (PR): None (N) - No privileges are required.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): None (N) - No data is exposed.
• Integrity (I): None (N) - No data is modified.
• Availability (A): Low (L) - The vulnerability can cause a denial of service (application crash).

Threat Level: Low. The vulnerability requires local access and only impacts availability. However, the public disclosure of the exploit increases the risk for systems where untrusted users have local access.

Deep Dive & Mechanics

The vulnerability resides in the glTF2::LazyDict class within the glTF2Asset.h file. The LazyDict is a dictionary-like structure used to lazily load glTF2 assets. The operator[] function is used to access elements by key. The vulnerability occurs when a null pointer is passed as the key or when the internal state of the LazyDict is manipulated to cause a null pointer dereference.

The specific code path is in the glTF2::LazyDict::operator[] function. When the function is called with a key that does not exist, it attempts to access a null pointer, leading to a crash. The patch (commit d24b85319bd70c65883a2b96613e07e23fb95981) adds a null check before dereferencing the pointer.

Vulnerable vs. Patched Code

Vulnerable Code (before patch):

// glTF2Asset.h
template<typename T>
T& LazyDict::operator[](const std::string& key) {
    // ... some code ...
    return *mDict[key]; // Potential null pointer dereference if mDict[key] is null
}

Patched Code (after patch):

// glTF2Asset.h
template<typename T>
T& LazyDict::operator[](const std::string& key) {
    // ... some code ...
    if (mDict[key] == nullptr) {
        // Handle null case, e.g., throw exception or return default
        throw std::runtime_error("Null pointer in LazyDict");
    }
    return *mDict[key];
}

The patch adds a null check before dereferencing the pointer, preventing the null pointer dereference.

Exploitation & Lab Setup

Red Team

Exploit Scenario: An attacker with local access to a system can craft a malicious glTF2 file that triggers the null pointer dereference when loaded by an application using the vulnerable Assimp library. This can cause the application to crash, leading to a denial of service.

Lab Setup:

1. Environment: Ubuntu 22.04 LTS with Assimp 6.0.4 installed.
2. Tools: Python 3, a text editor, and a glTF2 file.
3. Steps:
   • Create a malicious glTF2 file that triggers the vulnerability.
   • Use a Python script to load the file using the Assimp library.
   • Observe the crash.

Example Python Script (exploit.py):

import assimp

# Load malicious glTF2 file
scene = assimp.load('malicious.gltf')
print("Loaded successfully")

Malicious glTF2 File (malicious.gltf):

{
    "asset": {
        "version": "2.0"
    },
    "scenes": [
        {
            "nodes": [0]
        }
    ],
    "nodes": [
        {
            "mesh": 0
        }
    ],
    "meshes": [
        {
            "primitives": [
                {
                    "attributes": {
                        "POSITION": 0
                    },
                    "indices": 0
                }
            ]
        }
    ],
    "accessors": [
        {
            "bufferView": 0,
            "componentType": 5126,
            "count": 3,
            "type": "VEC3"
        }
    ],
    "bufferViews": [
        {
            "buffer": 0,
            "byteOffset": 0,
            "byteLength": 36
        }
    ],
    "buffers": [
        {
            "uri": "data:application/octet-stream;base64,AAAAAAAAAAAAAACAPwAAAAAAAAAAAAAAAAAAgD8AAAAAAAAAAAAAAIA/AAAAAAAAAAAAAIA/AAAAAAAAAAA=",
            "byteLength": 36
        }
    ]
}

Note: The above glTF2 file is a minimal valid file. To trigger the vulnerability, the file must contain a key that causes a null pointer dereference in the LazyDict. The exact trigger may require specific manipulation of the extensionsUsed or extensionsRequired fields.

Blue Team

Detection: Monitor for crashes in applications using Assimp when loading glTF2 files. Use the detection rules provided in the Detection Engineering section.

Mitigation: Apply the patch immediately. If patching is not possible, restrict local access to the system and avoid loading untrusted glTF2 files.

Indicators of Compromise (IOCs)

• File Hashes (malicious glTF2 file):
  • SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example, replace with actual hash)
• Process Behavior:
  • Application crash with a null pointer dereference in glTF2::LazyDict::operator[].
• Log Entries:
  • Application crash logs showing a segmentation fault in glTF2Asset.h.

Detection Engineering

YARA Rule

rule CVE_2026_10199_Assimp_Null_Pointer_Dereference {
    meta:
        description = "Detects malicious glTF2 files targeting CVE-2026-10199"
        author = "Valters IT"
        date = "2025-04-14"
        hash = "d24b85319bd70c65883a2b96613e07e23fb95981"
    strings:
        $s1 = "glTF2::LazyDict" ascii wide
        $s2 = "operator[]" ascii wide
        $s3 = "nullptr" ascii wide
    condition:
        all of them
}

Sigma Rule

title: CVE-2026-10199 - Assimp Null Pointer Dereference
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects crashes caused by CVE-2026-10199 in Assimp
author: Valters IT
date: 2025-04-14
logsource:
    category: application
    product: assimp
detection:
    selection:
        EventID: 1000
        ProviderName: "Application Error"
        Data: "*glTF2Asset.h*"
    condition: selection
falsepositives:
    - Unknown
level: low

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2026-10199 - Assimp Null Pointer Dereference"; flow:to_server; content:"glTF2"; content:"LazyDict"; content:"operator[]"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Apply the Patch: Update Assimp to a version that includes the patch (commit d24b85319bd70c65883a2b96613e07e23fb95981).
2. Restrict Local Access: Limit local access to systems running applications that use Assimp.
3. Input Validation: Validate glTF2 files before loading them with Assimp.
4. Use a WAF: If the application is web-based, use a Web Application Firewall to filter malicious glTF2 files.
5. Monitor Logs: Monitor application logs for crashes related to glTF2Asset.h.

Valters IT

This report is generated for educational and defensive purposes only.