CVE-2026-14604: Assimp Use-After-Free Vulnerability

CVE-2026-14604 Overview

CVE-2026-14604 is a double free vulnerability in the Open Asset Import Library (Assimp) affecting versions up to and including 6.0.4. The flaw resides in the Assimp::Exporter::ExportToBlob function within code/AssetLib/Ply/PlyLoader.cpp, part of the PLY Model Handler component. Attackers can trigger the condition remotely by supplying a crafted PLY model to an application that uses Assimp for asset import or export. A public proof-of-concept has been disclosed, increasing the risk of opportunistic exploitation. The issue is classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer).

Critical Impact
A public proof-of-concept exists for a remotely triggerable double free in Assimp's PLY handler, enabling denial of service and potential memory corruption in downstream applications.

Affected Products

Open Asset Import Library (Assimp) versions up to and including 6.0.4
Applications embedding the vulnerable PlyLoader component
3D content pipelines and model viewers linking against Assimp

Discovery Timeline

2026-07-03 - CVE-2026-14604 published to the National Vulnerability Database
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14604

Vulnerability Analysis

The vulnerability is a double free condition [CWE-119] in Assimp's PLY export code path. Double free bugs occur when the same memory region is released twice through free() or delete. The second release corrupts the allocator's internal metadata, which can lead to heap corruption, denial of service, or attacker-controlled writes depending on the allocator implementation.

Assimp is widely embedded in 3D rendering engines, CAD tools, and asset pipelines. Because the flaw is reachable through the standard export routine Assimp::Exporter::ExportToBlob, any application that processes attacker-supplied PLY models with Assimp inherits the exposure. The attack vector is network-adjacent when applications accept models from remote sources such as web uploads or shared repositories.

Root Cause

The root cause is improper ownership tracking of a heap buffer allocated during PLY export inside code/AssetLib/Ply/PlyLoader.cpp. An error path or cleanup routine releases a pointer that is subsequently freed again by the caller or the object destructor. The result is a double free on the same allocation.

Attack Vector

An authenticated user with low privileges can invoke the export functionality with a specially crafted PLY model. When the vulnerable code path executes, the double free corrupts the heap. In client applications that expose Assimp through a network-facing service such as a model conversion API or asset uploader, the input reaches the parser without direct user interaction. A public PoC archive is referenced in the GitHub Issue #6620 tracker.

No synthetic exploit code is included here. Technical reproduction details are available in the upstream issue tracker and the VulDB CVE-2026-14604 entry.

Detection Methods for CVE-2026-14604

Indicators of Compromise

Unexpected process termination or heap corruption warnings in applications that invoke Assimp's PLY exporter
Crash dumps referencing Assimp::Exporter::ExportToBlob or PlyLoader.cpp in the call stack
Ingestion of PLY files from untrusted sources immediately preceding a service crash

Detection Strategies

Enable AddressSanitizer (-fsanitize=address) or heap protection instrumentation in development and staging builds to surface double free events
Inventory software that statically or dynamically links Assimp <= 6.0.4 using Software Bill of Materials (SBOM) tooling
Alert on abnormal termination of asset processing services correlated with .ply file ingestion

Monitoring Recommendations

Log all PLY file submissions to model conversion or import services with source identity and file hash
Monitor endpoint telemetry for repeated crashes of processes that link Assimp
Correlate crash telemetry with recent file uploads to identify potential exploitation attempts

How to Mitigate CVE-2026-14604

Immediate Actions Required

Identify all applications and services that embed Assimp <= 6.0.4 and prioritize those exposing the PLY exporter to untrusted input
Restrict which authenticated users can submit PLY files to processing pipelines
Sandbox Assimp-based asset processing in a separate low-privilege process to contain memory corruption

Patch Information

At the time of publication, no fixed release version is referenced in the NVD entry. The maintainers were notified through GitHub Issue #6620. Monitor the upstream Assimp repository for a commit that corrects ownership of the buffer freed inside Assimp::Exporter::ExportToBlob and rebuild dependent applications once a patched release is available.

Workarounds

Disable the PLY exporter code path in applications that do not require PLY output
Reject .ply inputs from untrusted origins at the application gateway until a patched Assimp build is deployed
Run asset conversion workloads inside a container or seccomp-restricted sandbox to limit the blast radius of heap corruption

bash

# Example: block PLY uploads at a reverse proxy until Assimp is patched
# nginx snippet
location /upload {
    if ($request_filename ~* \.ply$) {
        return 403;
    }
    client_max_body_size 10m;
    proxy_pass http://asset_service;
}