CVE-2026-111128 — Assimp through 6.0.5 NULL Pointer Dereference via Ogre Importer Bone Assignment
Assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D importer that allows attackers to crash applications via unvalidated bone indices in OgreStr…
Published: 2026-10-15 · CVSS: 6.8 · CVSS 4.0
Assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D importer that allows attackers to crash applications via unvalidated bone indices in OgreStructs.cpp. Attackers can supply a crafted .mesh and .skeleton file referencing a missing bone, causing BoneById() to return null and crash the host process.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7