CVE-2026-10197

A flaw was found in Assimp. A local user with access to the system could exploit a null pointer dereference vulnerability in the glTF2Importer::ImportEmbeddedTextures function. This flaw could lead to a Denial of Service (DoS), making the application unavailable.

This Moderate impact null pointer dereference vulnerability in Assimp's glTF2Importer requires local system access to trigger a Denial of Service. While the flaw can make an application unavailable, its local nature limits the overall risk to Red Hat products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Users should avoid processing untrusted glTF2 files with applications that rely on the Assimp library. This vulnerability requires local access and the processing of a specially crafted file to trigger the null pointer dereference, leading to a denial of service.