CVE-2026-14604
Received Received - Intake

Double Free in Open Asset Import Library Assimp

Publication date: 2026-07-03

Last updated on: 2026-07-03

Assigner: VulDB

Description
A vulnerability was determined in Open Asset Import Library Assimp up to 6.0.4. Affected is the function Assimp::Exporter::ExportToBlob of the file code/AssetLib/Ply/PlyLoader.cpp of the component PLY Model Handler. This manipulation causes double free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-03
Last Modified
2026-07-03
Generated
2026-07-04
AI Q&A
2026-07-03
EPSS Evaluated
N/A
NVD
CVE-2026-14604
EUVD
EUVD-2026-41561

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
assimp open_asset_import_library to 6.0.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-415 The product calls free() twice on the same memory address.
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a double-free memory corruption issue in the Open Asset Import Library (Assimp) up to version 6.0.4. It specifically affects the function Assimp::Exporter::ExportToBlob in the PLY Model Handler component. The problem arises when a PLY model is loaded into memory and then exported, causing the same memory block (aiMesh) to be freed twice due to conflicting ownership between the importer and exporter components.

This double free can lead to memory corruption, which attackers can exploit remotely to cause unexpected behavior or crashes in applications using this library.

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Impact Analysis

The double-free vulnerability can lead to memory corruption, which may cause application crashes or undefined behavior. An attacker could exploit this remotely by providing specially crafted PLY files to trigger the double free, potentially leading to denial of service or other security issues in software that uses the affected Assimp library.

Detection Guidance

This vulnerability involves a double-free memory corruption in the Assimp library when processing PLY files, specifically triggered by using Assimp::Importer::ReadFileFromMemory followed by Assimp::Exporter::ExportToBlob.

Detection can be approached by monitoring for crashes or memory corruption events related to Assimp when handling PLY files.

Fuzzing techniques were used to discover this bug, so running fuzz tests against the PLY file processing functions in Assimp could help detect attempts to exploit this vulnerability.

No specific network or system commands are provided in the resources to detect this vulnerability directly.

Mitigation Strategies

The vulnerability arises from conflicting memory ownership between the importer and exporter components in Assimp when handling PLY files.

Immediate mitigation steps include avoiding the use of the vulnerable workflow: do not pass the aiScene pointer obtained from Assimp::Importer::ReadFileFromMemory directly to Assimp::Exporter::ExportToBlob.

Monitor for updates or patches from the Assimp project that address this double-free issue and apply them as soon as they become available.

Until a patch is applied, restrict or sanitize PLY file inputs to reduce the risk of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14604. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart