CVE-2026-14604
Open Asset Import Library Assimp PLY Model PlyLoader.cpp ExportToBlob double free
- State
- Published
- Severity
- 5.3 Medium
- Published
- Jul 3, 2026
- Updated
- Jul 6, 2026
- Reserved
- Jul 3, 2026
Description
A vulnerability was determined in Open Asset Import Library Assimp up to 6.0.4. Affected is the function Assimp::Exporter::ExportToBlob of the file code/AssetLib/Ply/PlyLoader.cpp of the component PLY Model Handler. This manipulation causes double free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
AssimpOpen Asset Import Library |
|
References
- VDB-376112 | Open Asset Import Library Assimp PLY Model PlyLoader.cpp ExportToBlob double freevdb-entrytechnical-description
- VDB-376112 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2026-14604 | CVE Analysis and Reportthird-party-advisory
- Submit #844567 | Assimp commit 17c12da Double Freethird-party-advisory
- https://github.com/assimp/assimp/issues/6620issue-tracking
- https://github.com/user-attachments/files/27232640/poc.zipexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.