assimp has 6 CVEs on record between 2025 and 2026. 3 were published in the last 90 days. The busiest recent month was October 2026 with 3. The median CVSS is 5.4 (medium). None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.4
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Worst active — by depth score
CVE-2026-111129Medium· 5.5Open Asset Import Library (assimp) through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D binary mesh importer's OgreBinarySerializer::ReadAnimationKeyFrames() handling of unvalidated animation track targets42CVE-2026-111128Medium· 5.5Assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D importer that allows attackers to crash applications via unvalidated bone indices in OgreStructs.cpp42CVE-2026-117608Medium· 6.1Assimp through 6.0.5 Heap Out-of-Bounds Read via MD2 Importer Integer Overflow34CVE-2025-11277Medium· 5.3A weakness has been identified in Open Asset Import Library Assimp 6.0.229CVE-2025-11275Medium· 5.3A vulnerability was identified in Open Asset Import Library Assimp 6.0.229
assimp vulnerabilities
CVEs affecting assimp, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
CVE-2026-117608Medium· 6.1Assimp through 6.0.5 Heap Out-of-Bounds Read via MD2 Importer Integer Overflow
Assimp through 6.0.5 contains an integer overflow vulnerability in MD2Importer::ValidateHeader() that allows attackers to bypass frame table bounds checks using crafted header fields. Attackers can supply a malicious .md2 file whose numF…
CVE-2026-111129Medium· 5.5PoCOpen Asset Import Library (assimp) through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D binary mesh importer's OgreBinarySerializer::ReadAnimationKeyFrames() handling of unvalidated animation track targets
Open Asset Import Library (assimp) through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D binary mesh importer's OgreBinarySerializer::ReadAnimationKeyFrames() handling of unvalidated animation track targets. Attac…
CVE-2026-111128Medium· 5.5PoCAssimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D importer that allows attackers to crash applications via unvalidated bone indices in OgreStructs.cpp
Assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D importer that allows attackers to crash applications via unvalidated bone indices in OgreStructs.cpp. Attackers can supply a crafted .mesh and .skeleton…
CVE-2025-11277Medium· 5.3A weakness has been identified in Open Asset Import Library Assimp 6.0.2
A weakness has been identified in Open Asset Import Library Assimp 6.0.2. This affects the function Q3DImporter::InternReadFile of the file assimp/code/AssetLib/Q3D/Q3DLoader.cpp. Executing a manipulation can lead to heap-based buffer ov…
CVE-2025-11275Medium· 5.3A vulnerability was identified in Open Asset Import Library Assimp 6.0.2
A vulnerability was identified in Open Asset Import Library Assimp 6.0.2. Affected by this vulnerability is the function ODDLParser::getNextSeparator in the library assimp/contrib/openddlparser/include/openddlparser/OpenDDLParserUtils.h.…
CVE-2025-11274Low· 3.3A vulnerability was determined in Open Asset Import Library Assimp 6.0.2
A vulnerability was determined in Open Asset Import Library Assimp 6.0.2. Affected is the function Q3DImporter::InternReadFile of the file assimp/code/AssetLib/Q3D/Q3DLoader.cpp. This manipulation causes allocation of resources. The atta…