CVE-2026-10232
Assimp ASE File scene.cpp ~aiNode use after free
- State
- Published
- Severity
- 4.8 Medium
- Published
- Jun 1, 2026
- Updated
- Jun 2, 2026
- Reserved
- May 31, 2026
Description
A weakness has been identified in Assimp up to 6.0.4. Affected by this vulnerability is the function aiNode::~aiNode of the file scene.cpp of the component ASE File Parser. Executing a manipulation can lead to use after free. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. The project tagged the reported issue as bug.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 4.8 Medium | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 5.3 Medium | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 4.3 Medium | AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Assimpn/a |
|
References
- VDB-367511 | Assimp ASE File scene.cpp ~aiNode use after freevdb-entrytechnical-description
- VDB-367511 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2026-10232 | CVE Analysis and Reportthird-party-advisory
- Submit #821192 | Assimp commit 17c12da Memory Corruptionthird-party-advisory
- https://github.com/assimp/assimp/issues/6617issue-tracking
- https://github.com/user-attachments/files/27200601/poc.zipexploit
- https://github.com/assimp/assimp/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.