CVE-2026-111129

Open Asset Import Library assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D binary mesh importer's OgreBinarySerializer::ReadAnimationKeyFrames handling of unvalidated animation track targets. Attackers can supply a crafted .mesh file with a morph animation trac...

CVE-2026-111144

The libansilove library, specifically versions 1.3.0 through 1.4.2 , is vulnerable to a NULL pointer dereference within the ansilove_xbin() function. An attacker can cause an application to crash by providing a crafted XBIN file that sets the 512-character flag without the corresponding custom-fo...

CVE-2026-111144 libansilove 1.3.0 through 1.4.2 NULL Pointer Dereference via ansilove_xbin

libansilove 1.3.0 through 1.4.2 contains a NULL pointer dereference vulnerability in ansilovexbin that allows attackers to crash applications by supplying a crafted XBIN file. Attackers can set the 512-character flag without the custom-font flag, causing drawchar to index a NULL highfontdataxbin...

CVE-2026-111144

libansilove 1.3.0 through 1.4.2 contains a NULL pointer dereference vulnerability in ansilovexbin that allows attackers to crash applications by supplying a crafted XBIN file. Attackers can set the 512-character flag without the custom-font flag, causing drawchar to index a NULL highfontdataxbin...

CVE-2026-111144 libansilove 1.3.0 through 1.4.2 NULL Pointer Dereference via ansilove_xbin

libansilove 1.3.0 through 1.4.2 contains a NULL pointer dereference vulnerability in ansilovexbin that allows attackers to crash applications by supplying a crafted XBIN file. Attackers can set the 512-character flag without the custom-font flag, causing drawchar to index a NULL highfontdataxbin...

CVE-2026-111129

The Open Asset Import Library (assimp) through version 6.0.5 is vulnerable to a NULL pointer dereference within the Ogre3D binary mesh importer. Specifically, the OgreBinarySerializer::ReadAnimationKeyFrames() function fails to properly validate animation track targets. An attacker can provide a ...

CVE-2026-111129 Assimp through 6.0.5 NULL Pointer Dereference via Ogre Animation Track

Open Asset Import Library assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D binary mesh importer's OgreBinarySerializer::ReadAnimationKeyFrames handling of unvalidated animation track targets. Attackers can supply a crafted .mesh file with a morph animation trac...

EUVD-2026-102360

Open Asset Import Library assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D binary mesh importer's OgreBinarySerializer::ReadAnimationKeyFrames handling of unvalidated animation track targets. Attackers can supply a crafted .mesh file with a morph animation trac...

CVE-2026-111129 Assimp through 6.0.5 NULL Pointer Dereference via Ogre Animation Track

Open Asset Import Library assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D binary mesh importer's OgreBinarySerializer::ReadAnimationKeyFrames handling of unvalidated animation track targets. Attackers can supply a crafted .mesh file with a morph animation trac...

CVE-2026-111129

Open Asset Import Library assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D binary mesh importer's OgreBinarySerializer::ReadAnimationKeyFrames handling of unvalidated animation track targets. Attackers can supply a crafted .mesh file with a morph animation trac...

CVE-2026-111128 Assimp through 6.0.5 NULL Pointer Dereference via Ogre Importer Bone Assignment

Assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D importer that allows attackers to crash applications via unvalidated bone indices in OgreStructs.cpp. Attackers can supply a crafted .mesh and .skeleton file referencing a missing bone, causing BoneById to return...

EUVD-2026-102359

Assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D importer that allows attackers to crash applications via unvalidated bone indices in OgreStructs.cpp. Attackers can supply a crafted .mesh and .skeleton file referencing a missing bone, causing BoneById to return...

CVE-2026-111128

The Assimp library, in versions through 6.0.5 , is vulnerable to a NULL pointer dereference within the Ogre3D importer . The flaw exists in OgreStructs.cpp, where the application fails to validate bone indices. An attacker can trigger a crash of the host process by providing a crafted .mesh and ....

CVE-2026-111128 Assimp through 6.0.5 NULL Pointer Dereference via Ogre Importer Bone Assignment

Assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D importer that allows attackers to crash applications via unvalidated bone indices in OgreStructs.cpp. Attackers can supply a crafted .mesh and .skeleton file referencing a missing bone, causing BoneById to return...

CVE-2026-111128 Assimp through 6.0.5 NULL Pointer Dereference via Ogre Importer Bone Assignment

Assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D importer that allows attackers to crash applications via unvalidated bone indices in OgreStructs.cpp. Attackers can supply a crafted .mesh and .skeleton file referencing a missing bone, causing BoneById to return...

CVE-2026-111128

Assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D importer that allows attackers to crash applications via unvalidated bone indices in OgreStructs.cpp. Attackers can supply a crafted .mesh and .skeleton file referencing a missing bone, causing BoneById to return...

CVE-2026-110659

A flaw was found in elfio. This vulnerability allows an attacker to cause a Denial of Service DoS by crashing applications that process untrusted binaries. By supplying a specially crafted Executable and Linkable Format ELF file containing an invalid relocation section link, an attacker triggers ...

CVE-2026-100349

A flaw was found in kin-openapi. This vulnerability allows an attacker to cause a Denial of Service DoS by triggering an application crash during response validation. When an OpenAPI specification declares a response header using content rather than a schema, the validation logic attempts to...

CVE-2026-100353

kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI 3.1 array schemas. An unauthenticated remote client can trigger a deterministic...

CVE-2026-97394

kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-form-urlencoded or multipart/form-data request bodies,...