CVE-2026-111128

Deferred Deferred - Pending Action

NULL Pointer Dereference in Assimp Ogre3D Importer

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

Assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D importer that allows attackers to crash applications via unvalidated bone indices in OgreStructs.cpp. Attackers can supply a crafted .mesh and .skeleton file referencing a missing bone, causing BoneById() to return null and crash the host process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-111128

EUVD

EUVD-2026-102359

Affected Vendors & Products

Vendor	Product	Version / Range
assimp	assimp	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability is a NULL pointer dereference in the Assimp library through version 6.0.5, specifically in the Ogre3D importer. It occurs when unvalidated bone indices in OgreStructs.cpp reference missing bones in crafted .mesh and .skeleton files. The BoneById() function returns null for missing bones, causing the application to crash when attempting to dereference the pointer.

Detection Guidance

To detect this vulnerability, inspect files processed by Assimp for malformed .mesh or .skeleton files. Check for crashes when loading Ogre3D files. Use static analysis tools to scan Assimp versions up to 6.0.5 for NULL pointer dereferences in OgreStructs.cpp.

Impact Analysis

This vulnerability allows attackers to crash applications using Assimp by providing malicious .mesh and .skeleton files. Successful exploitation could lead to denial of service, application instability, or potential arbitrary code execution depending on the application's context and memory management.

Compliance Impact

This vulnerability primarily causes application crashes due to NULL pointer dereferences, which could lead to denial of service conditions. While not directly violating GDPR or HIPAA, such crashes may disrupt systems handling sensitive data, potentially causing data processing interruptions or loss of availability. Compliance depends on how the affected applications are used in regulated environments.

Mitigation Strategies

Update Assimp to a version beyond 6.0.5 where the NULL pointer checks in OgreStructs.cpp are fixed. Avoid processing untrusted .mesh and .skeleton files. Implement input validation for bone indices and submesh references in Ogre3D importer.

Hi! I’m here to help you understand CVE-2026-111128. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70