CVE-2026-14604

A vulnerability was determined in Open Asset Import Library Assimp up to 6.0.4. Affected is the function Assimp::Exporter::ExportToBlob of the file code/AssetLib/Ply/PlyLoader.cpp of the component PLY Model Handler. This manipulation causes double free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14604.json",
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-119",
        "CWE-415"
    ]
}

References

Affected packages

Git / github.com/assimp/assimp

Affected ranges

Type

GIT

Repo

https://github.com/assimp/assimp

Events

Introduced

c4515f53ca9a60cf4645b9bc837faaf14026b6d1

Last affected

e0b52347c6e52de2827ec957a9ebf00ce3c54f79

Database specific

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "6.0.0"
        },
        {
            "last_affected": "6.0.0"
        },
        {
            "introduced": "6.0.1"
        },
        {
            "last_affected": "6.0.1"
        },
        {
            "introduced": "6.0.2"
        },
        {
            "last_affected": "6.0.2"
        },
        {
            "introduced": "6.0.3"
        },
        {
            "last_affected": "6.0.3"
        },
        {
            "introduced": "6.0.4"
        },
        {
            "last_affected": "6.0.4"
        }
    ]
}

Affected versions

6.*

6.0.0

6.0.1

6.0.2

6.0.3

6.0.4

v6.*

v6.0.0

v6.0.1

v6.0.2

v6.0.3

v6.0.4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14604.json"