Log in Start free

Vulnerability · Published Jul 3, 2026 · Assigned by VulDB

CVE-2026-14604Open Asset Import Library Assimp PLY Model PlyLoader.cpp ExportToBlob double free

Medium 6.3

In plain English

A medium-severity double free in Assimp from Open Asset Import Library. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.2%top 85.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in Open Asset Import Library Assimp up to 6.0.4. Affected is the function Assimp::Exporter::ExportToBlob of the file code/AssetLib/Ply/PlyLoader.cpp of the component PLY Model Handler. This manipulation causes double free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12assimpno fix listedDEBIAN-CVE-2026-14604
Debian:13assimpno fix listedDEBIAN-CVE-2026-14604
Debian:14assimpno fix listedDEBIAN-CVE-2026-14604
Ubuntu:22.04:LTSassimpno fix listedUBUNTU-CVE-2026-14604
Ubuntu:24.04:LTSassimpno fix listedUBUNTU-CVE-2026-14604
Ubuntu:25.10assimpno fix listedUBUNTU-CVE-2026-14604
Ubuntu:26.04:LTSassimpno fix listedUBUNTU-CVE-2026-14604
Ubuntu:26.10assimpno fix listedUBUNTU-CVE-2026-14604

Affected products (as reported)

VendorProductVersions
Open Asset Import Library Assimp 6.0.06.0.16.0.26.0.36.0.4

Weakness: CWE-415, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References