CVE-2026-10201

Executive Summary

CVE-2026-10201 is a locally exploitable divide-by-zero vulnerability in the Assimp library, affecting versions up to and including 6.0.4. The flaw resides in the FBXExporter::WriteObjects function within FBXExporter.cpp, specifically in the UV Channel Handler component. An attacker with local access can trigger a denial of service (DoS) by providing a crafted input that causes a division by zero. The vulnerability has been publicly disclosed, and while no official patch has been released, the project has acknowledged it as a bug. The CVSS score is 3.3 (Low), reflecting the local attack vector and limited impact (availability only).

Supply Chain & Package Security

Assimp (Open Asset Import Library) is a widely used C++ library for importing and exporting 3D model formats. It is integrated into numerous applications, game engines, and tools. This vulnerability poses a supply chain risk: any application that bundles Assimp and processes untrusted FBX files locally could be susceptible to a DoS attack. Developers should monitor for patched versions and consider input validation or sandboxing for FBX processing.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – Requires local file system access.
• Attack Complexity (AC): Low (L) – No special conditions needed.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required beyond opening a file.
• Scope (S): Unchanged (U) – Impact is confined to the vulnerable component.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): Low (L) – Causes application crash or hang.

Threat Level: Low. Exploitation requires local access and results only in denial of service. However, in environments where Assimp processes files from untrusted sources (e.g., a game server loading user-uploaded models), the risk increases.

Deep Dive & Mechanics

The vulnerability is a classic divide-by-zero error in the FBXExporter::WriteObjects function. When exporting FBX data, the UV Channel Handler processes vertex UV coordinates. If a crafted input file contains a UV channel with zero-length or malformed data, the code may attempt to divide by a value that is zero, leading to a floating-point exception (SIGFPE) and application crash.

The specific code path is in FBXExporter.cpp. The function likely iterates over UV channels and performs normalization or scaling operations without checking for zero divisors. An attacker can craft an FBX file (or a model file that Assimp imports and then exports) that triggers this condition.

Vulnerable vs. Patched Code

Vulnerable Code (Assimp <= 6.0.4):

// FBXExporter.cpp (simplified)
void FBXExporter::WriteObjects(aiScene const* scene) {
    for (auto& mesh : scene->mMeshes) {
        for (unsigned int c = 0; c < mesh->mNumUVComponents; ++c) {
            // Assume mNumUVComponents[c] is non-zero
            float scale = 1.0f / mesh->mNumUVComponents[c]; // DIVIDE BY ZERO
            // ... process UV data
        }
    }
}

Patched Code (Hypothetical):

// FBXExporter.cpp (patched)
void FBXExporter::WriteObjects(aiScene const* scene) {
    for (auto& mesh : scene->mMeshes) {
        for (unsigned int c = 0; c < mesh->mNumUVComponents; ++c) {
            if (mesh->mNumUVComponents[c] == 0) {
                // Skip or handle zero-length UV channel
                continue;
            }
            float scale = 1.0f / mesh->mNumUVComponents[c];
            // ... process UV data
        }
    }
}

Exploitation & Lab Setup

Red Team (Exploitation)

1. Craft a Malicious FBX File: Create an FBX file with a mesh that has a UV channel with zero components. This can be done by manually editing an FBX file or using a 3D modeling tool to export a model with an empty UV set.
2. Trigger the Vulnerability: Load the crafted FBX file into an application that uses Assimp for import/export. For example, use the assimp command-line tool:

   assimp export malicious.fbx output.obj
   

   This will cause a crash due to division by zero.

Proof-of-Concept (Python):

# craft_fbx.py - Generate a minimal FBX with zero UV components
import struct

def create_malicious_fbx():
    # Simplified FBX binary header and node structure
    # This is a placeholder; actual FBX binary format is complex
    # For demonstration, we assume a crafted file triggers the bug
    with open('malicious.fbx', 'wb') as f:
        # Write FBX header
        f.write(b'Kaydara FBX Binary  \x00\x1a\x00')
        # ... (omitted for brevity)
        # Include a mesh node with UV channel count = 0
        # This would cause the divide-by-zero
    print("Created malicious.fbx")

if __name__ == "__main__":
    create_malicious_fbx()

Blue Team (Detection & Defense)

1. Monitor for Crashes: Use application crash dumps or logs to detect SIGFPE signals in processes using Assimp.
2. Input Validation: Implement pre-processing checks on FBX files to ensure UV channel counts are non-zero before passing to Assimp.
3. Sandboxing: Run Assimp in a sandboxed environment (e.g., Docker, seccomp) to limit the impact of a crash.
4. Update: Apply the patch from the Assimp project once released, or implement the zero-check workaround in your own code.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – actual hash depends on crafted file)
  • malicious.fbx: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Process Behavior: Application crash with signal 8 (SIGFPE) in FBXExporter::WriteObjects.
• Log Entries:
  • Floating point exception (core dumped)
  • SIGFPE in stack trace pointing to FBXExporter.cpp
• Network: None (local exploitation only).

Detection Engineering

YARA Rule

rule CVE_2026_10201_Assimp_DivideByZero {
    meta:
        description = "Detects crafted FBX files exploiting CVE-2026-10201"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
    strings:
        $fbx_header = "Kaydara FBX Binary"
        $uv_zero = { 00 00 00 00 } // Placeholder for zero UV component count
    condition:
        $fbx_header at 0 and $uv_zero
}

Sigma Rule

title: CVE-2026-10201 Assimp Divide-by-Zero Exploitation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects crashes caused by divide-by-zero in Assimp FBX exporter
author: Valters IT
logsource:
    category: application
    product: linux
    service: syslog
detection:
    selection:
        - EventID: 7  # SIGFPE on Linux
        - Message: "*Floating point exception*"
        - StackTrace: "*FBXExporter::WriteObjects*"
    condition: selection
falsepositives:
    - Legitimate FBX files with zero UV channels (rare)
level: low

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2026-10201 Assimp Divide-by-Zero Attempt"; flow:to_server; content:"|4b 61 79 64 61 72 61 20 46 42 58 20 42 69 6e 61 72 79|"; distance:0; within:18; content:"|00 00 00 00|"; distance:0; within:4; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Apply the workaround by adding a zero-check before division in FBXExporter.cpp (see patched code above).
2. Short-term: Monitor the Assimp project for an official patch and update to the latest version.
3. Long-term: Implement input validation for all 3D model files processed by Assimp. Consider using a sandbox or separate process for file parsing to isolate crashes.
4. Detection: Deploy the YARA, Sigma, and Suricata rules to detect exploitation attempts.

Valters IT
Securing Digital Frontiers