CVE-2026-14604Medium· 6.3▾ Sunlit

A vulnerability was determined in Open Asset Import Library Assimp up to 6.0.4

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score35/ 100 · Low

impact 34.7 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Jul 3, 2026

Updated

Jul 3, 2026

CVSS

6.3

Vendor

—

Product

—

CWE

CWE-119, CWE-415

Depth score

35 · Low

EPSS

0.23% · p14

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS history

Exploit-prediction probability, daily snapshots since Jul 31.

0.2% → 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 52 days

Jul 3, 2026Published
Disclosed via NVD
Jul 31, 2026EPSS first tracked
0.2%
Aug 24, 2026EPSS peak
0.2% → 0.4%

CWE-119 CWE-415 #nvd

Full technical detail▾

Overview

A vulnerability was determined in Open Asset Import Library Assimp up to 6.0.4. Affected is the function Assimp::Exporter::ExportToBlob of the file code/AssetLib/Ply/PlyLoader.cpp of the component PLY Model Handler. This manipulation causes double free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd