p PatchFirst

CVE-2026-14604

CVE-2026-14604 · Open Asset Import Library Assimp PLY Model PlyLoader.cpp ExportToBlob double free

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A vulnerability was determined in Open Asset Import Library Assimp up to 6.0.4. Affected is the function Assimp::Exporter::ExportToBlob of the file code/AssetLib/Ply/PlyLoader.cpp of the component PLY Model Handler. This manipulation causes double free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report.

CVSS 5.3 · Medium · EPSS 0.2%

Published
Updated

Stack: system

Affected products and versions

  • assimp

    Versions
    • 6.0.0: Affected
    • 6.0.1: Affected
    • 6.0.2: Affected
    • 6.0.3: Affected
    • 6.0.4: Affected

    No fix published

  • assimp Debian:12

    Versions
    • 5.2.5~ds0-1
    • 5.2.5~ds0-1.1
    • 5.3.1+ds-1
    • 5.3.1+ds-2
    • 5.4.0+ds-1
    • 5.4.1+ds-1
    • 5.4.2+ds-1
    • 5.4.3+ds-2
    • 5.4.3+ds-3
    • 6.0.2+ds-1
    • 6.0.3+ds-1
    • 6.0.4+ds-1
    • 6.0.4+ds-3
    • 6.0.5+ds-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • assimp Debian:13

    Versions
    • 5.4.3+ds-2
    • 5.4.3+ds-3
    • 6.0.2+ds-1
    • 6.0.3+ds-1
    • 6.0.4+ds-1
    • 6.0.4+ds-3
    • 6.0.5+ds-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • assimp Debian:14

    Versions
    • 5.4.3+ds-2
    • 5.4.3+ds-3
    • 6.0.2+ds-1
    • 6.0.3+ds-1
    • 6.0.4+ds-1
    • 6.0.4+ds-3
    • 6.0.5+ds-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • assimp Ubuntu:16.04:LTS

    Versions
    • 3.0~dfsg-4ubuntu4
    • 3.1.1~dfsg-5
    • 3.2~dfsg-1
    • 3.2~dfsg-2
    • 3.2~dfsg-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • assimp Ubuntu:18.04:LTS

    Versions
    • 3.3.1~dfsg-5
    • 3.3.1~dfsg-5ubuntu1
    • 3.3.1~dfsg-5+build1
    • 4.0.1~dfsg-1~exp2
    • 4.0.1~dfsg-1
    • 4.1.0~dfsg-1
    • 4.1.0~dfsg-2
    • 4.1.0~dfsg-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • assimp Ubuntu:20.04:LTS

    Versions
    • 4.1.0~dfsg-5
    • 4.1.0~dfsg-5ubuntu1
    • 5.0.1~ds0-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • assimp Ubuntu:22.04:LTS

    Versions
    • 5.0.1~ds0-2
    • 5.0.1~ds0-3ubuntu1
    • 5.1.4~ds0-1
    • 5.1.5~ds0-1
    • 5.1.6~ds0-1
    • 5.2.0~ds0-2
    • 5.2.1~ds0-1
    • 5.2.2~ds0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • assimp Ubuntu:24.04:LTS

    Versions
    • 5.2.5~ds0-1.1build1
    • 5.3.1+ds-1
    • 5.3.1+ds-2
    • 5.3.1+ds-2build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • assimp Ubuntu:25.10

    Versions
    • 5.4.3+ds-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • assimp Ubuntu:26.10

    Versions
    • 6.0.4+ds-1build1
    • 6.0.5+ds-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • assimp Ubuntu:26.04:LTS

    Versions
    • 5.4.3+ds-2
    • 6.0.2+ds-1
    • 6.0.3+ds-1
    • 6.0.4+ds-1
    • 6.0.4+ds-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →