{"id":"CVE-2026-111129","summary":"Assimp through 6.0.5 NULL Pointer Dereference via Ogre Animation Track","details":"Open Asset Import Library (assimp) through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D binary mesh importer's OgreBinarySerializer::ReadAnimationKeyFrames() handling of unvalidated animation track targets. Attackers can supply a crafted .mesh file with a morph animation track targeting a missing submesh or absent shared geometry to crash the host process.","modified":"2026-10-17T07:06:57.821894883Z","published":"2026-10-15T18:57:25.146Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111129.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-476"]},"references":[{"type":"WEB","url":"https://github.com"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111129.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111129"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/assimp-through-6.0.5-null-pointer-dereference-via-ogre-animation-track"},{"type":"PACKAGE","url":"https://github.com/assimp/assimp"},{"type":"ARTICLE","url":"https://github.com/assimp/assimp/blob/392a658f9c271be965271f45e7521a1b80ea4392/code/AssetLib/Ogre/OgreBinarySerializer.cpp#L688-L704"},{"type":"ARTICLE","url":"https://github.com/assimp/assimp/blob/392a658f9c271be965271f45e7521a1b80ea4392/code/AssetLib/Ogre/OgreStructs.cpp#L839-L846"},{"type":"ARTICLE","url":"https://hackmd.io/@haind-pwn/assimp-ogre-mesh-bone-submesh-null-deref"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/assimp/assimp","events":[{"introduced":"0"},{"fixed":"392a658f9c271be965271f45e7521a1b80ea4392"}],"database_specific":{"source":["AFFECTED_FIELD","DESCRIPTION"],"extracted_events":[{"introduced":"0"},{"last_affected":"6.0.5"},{"fixed":"6.0.5"}]}}],"versions":["v6.0.4","v6.0.3","v6.0.2","v6.0.1","v6.0.0","v5.4.3","v5.4.2","v5.4.1","v5.4.0","v5.3.1","v5.3.0","v5.2.5","v5.2.4","v5.2.3","v5.2.2","v5.2.0","v5.2.1","5.2.0","v5.1.4","v5.1.6","v5.1.5","v5.1.3","v5.1.2","v5.1.1","v5.1.0","v5.1.0.rc1","v5.0.0","v.5.0.0.rc2","v.5.0.0.rc1","v4.1.0","v4.0.0","v4.0.0.rc1","v3.3.1","v3.3","v3.2","v3.1.1","v3.1-rc2","Release3.1_RC1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111129.json","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/assimp/assimp/commit/392a658f9c271be965271f45e7521a1b80ea4392","target":{"file":"code/AssetLib/FBX/FBXMeshGeometry.h"},"deprecated":false,"digest":{"line_hashes":["27692014881285194691561622447537787951","39253048890512981188941182852527352442","304515603240399722730009819396993314430","204083138976727508596511407742418605418","164956173743063573467068450419370341486","167933303282877892945942129059821126675","316064355110123121820429484123489486057"],"threshold":0.9},"id":"CVE-2026-111129-0860a1a0","signature_type":"Line"},{"source":"https://github.com/assimp/assimp/commit/392a658f9c271be965271f45e7521a1b80ea4392","target":{"file":"code/AssetLib/FBX/FBXMeshGeometry.cpp"},"deprecated":false,"digest":{"line_hashes":["323668607515367773953596743829384823948","29311537424724096178225356686330677262","15220157623906928669701039719593785049","89793544368969766570145196389845420078","93130672866023004483881294433105343152","45873150063810799438634435383403761899","101001851589783770891847202015173886793","104491039173454555306311126925157879112","187961930593724758014197833591810619024","301394150497113916109783977845557112641"],"threshold":0.9},"id":"CVE-2026-111129-2f44c0dd","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/assimp/assimp/commit/392a658f9c271be965271f45e7521a1b80ea4392","target":{"file":"code/AssetLib/FBX/FBXDeformer.cpp"},"deprecated":false,"digest":{"line_hashes":["339608192247037740547048956127348140741","156014530357942643717923122900520476807","309463876195724112251104440818900863590","327471024863588339328215984736238039427","43406183717224759605657949941902382046","128672872119516388673888076193586169527","257644645986971252782156081574817035780","243157626499678641583376129231065247689","49086252438485802955276168826088476528","87455191631433331215196493652663083119","115104940716110644517606388422622639055"],"threshold":0.9},"id":"CVE-2026-111129-3aea3a3b","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/assimp/assimp/commit/392a658f9c271be965271f45e7521a1b80ea4392","target":{"function":"BlendShapeChannel::BlendShapeChannel","file":"code/AssetLib/FBX/FBXDeformer.cpp"},"deprecated":false,"digest":{"length":973,"function_hash":"333598703492155084873707095721343554599"},"id":"CVE-2026-111129-4220f2f3"},{"target":{"file":"code/AssetLib/FBX/FBXMeshGeometry.cpp","function":"Geometry::Geometry"},"deprecated":false,"digest":{"function_hash":"46258321064962827785694896223047586104","length":717},"id":"CVE-2026-111129-646b8a03","signature_type":"Function","signature_version":"v1","source":"https://github.com/assimp/assimp/commit/392a658f9c271be965271f45e7521a1b80ea4392"},{"target":{"file":"code/AssetLib/FBX/FBXDeformer.cpp","function":"BlendShape::BlendShape"},"deprecated":false,"digest":{"function_hash":"96864180255120193407218731277955950871","length":679},"id":"CVE-2026-111129-82f5e1fc","signature_type":"Function","signature_version":"v1","source":"https://github.com/assimp/assimp/commit/392a658f9c271be965271f45e7521a1b80ea4392"},{"id":"CVE-2026-111129-8b22c4d2","signature_type":"Line","signature_version":"v1","source":"https://github.com/assimp/assimp/commit/392a658f9c271be965271f45e7521a1b80ea4392","target":{"file":"code/PostProcessing/ImproveCacheLocality.cpp"},"deprecated":false,"digest":{"line_hashes":["94823343920478411843415786176309316915","272382117407527979899199172448999808016","197346779194247690376171744793588375271","732309940712464483497036590859793275","138825866515623794852935179837018242523","235431720237579789509842386418291812875","80764802348296636802867912586945261524","114504920905049428617680986469104638090","64991953903722437328623362736908342773","85985995331660980857450355701337871364","102442688291544592864395153395278247964","20122491260552506554426765647521880165","226569071619392368773759894394046743545","57363604334698127376333714391663818027","227175924902277052449684856398184389416","30618119003684187136391856263133957421","135416553652026887907842748721875914516","123062686672793356711325887380040556115","325466136289312785075176041071526995854","132447262070407447175373196542115422005","259634912155635043955121518558246166888","196848348207606459302362239363525989435","42269721566682257395215911675727618650","134611002798642957786887789448221908134","255857952782131658065171899462578281617","178268530970541697930206473691845796180","180020188426629520238778807285905882200","176267016016326931547721915643515994814","67417155458241626776298803998551281142","187862767754652820216200917363598431624","220020511757987790795974818275283225484","43986496268077087973438181210458906724","132443341695799312829966594420191905280","330030962689998541263292718468240969941","247921586123184701884029279231880643240","41955926594346195335080130636082762422","250482924231043871398430125121382533265","110997015603021710008958902404840012617","215092308320895824335782080029994309775","216225488099568506208171415853802027931","254406077365944221096183066958963027579","329122427681117608609278231107471423219","128827496530435593036067533683117311570","197247967855632593486229314087761931688","17839260429222826752918088470649701936"],"threshold":0.9}},{"source":"https://github.com/assimp/assimp/commit/392a658f9c271be965271f45e7521a1b80ea4392","target":{"file":"code/AssetLib/FBX/FBXDocument.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["12997149430841940083927700873081881444","29896068796608509505986306120952879355","216651068131283108914423267766037310684","107349648103148707946519274864549421115","308559941439546287475675409968664219664","21088071096434809540032128830558475695","138015103341494381740901979433853078529","316631868053427400471928827379121443784","156797443888839777970796101821918256789","102392570551970673311922750894642094519","313667816254431316384496914676933813475","337549733545281580168346765995998877580","335471202388807178336048802426862915612","15015381384576419749470006678663205141","315996032171167702688680643124677904028","278293636803497223775520698127044343083","83090963155847738774234135480901910815","183363990408153425329524539917447444157"]},"id":"CVE-2026-111129-f80f1912","signature_type":"Line","signature_version":"v1"}],"vanir_signatures_modified":"2026-10-17T07:06:57Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}