CVE-2026-14604

MEDIUM

Open Asset Import Library Assimp PLY Model PlyLoader.cpp ExportToBlob double free

Title source: cna
STIX 2.1

Description

A vulnerability was determined in Open Asset Import Library Assimp up to 6.0.4. Affected is the function Assimp::Exporter::ExportToBlob of the file code/AssetLib/Ply/PlyLoader.cpp of the component PLY Model Handler. This manipulation causes double free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report.

References (6)

Core 6
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-376112 | Open Asset Import Library Assimp PLY Model PlyLoader.cpp ExportToBlob double free
https://vuldb.com/vuln/376112
Signature, Permissions Required signature permissions-required
VDB-376112 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/vuln/376112/cti
Third Party Advisory third-party-advisory
CVE-2026-14604 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-14604
Third Party Advisory third-party-advisory
Submit #844567 | Assimp commit 17c12da Double Free
https://vuldb.com/submit/844567
Issue Tracking issue-tracking
https://github.com/assimp/assimp/issues/6620

Scores

CVSS v3 6.3
EPSS 0.0023
EPSS Percentile 14.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-119 CWE-415
Status published
Products (5)
Open Asset Import Library/Assimp 6.0.0
Open Asset Import Library/Assimp 6.0.1
Open Asset Import Library/Assimp 6.0.2
Open Asset Import Library/Assimp 6.0.3
Open Asset Import Library/Assimp 6.0.4
Published Jul 03, 2026
Tracked Since Jul 04, 2026