Executive brief
Assimp is a widely used library for importing various 3D model formats into applications. A vulnerability in its ASE file parser could allow an attacker to crash an application or potentially execute unauthorized code by providing a specially crafted 3D model file. This could impact the stability of software that relies on Assimp to process user-supplied 3D assets.
Technical details
A heap-use-after-free vulnerability exists in Assimp up to version 6.0.4 within the ASE (ASCII Scene Export) file parser. The flaw is located in the aiNode::~aiNode() destructor in scene.cpp, which is triggered during recursive node destruction when processing a malformed ASE file. An attacker can exploit this by providing a crafted ASE file that creates an invalid node tree, leading to a use-after-free condition during memory deallocation. This requires local access to provide the malicious file to the library. A public proof-of-concept (PoC) has been released.
Affected products
- Assimp Assimp up to 6.0.4
Timeline
- 2026-06-01: disclosed: Vulnerability disclosed and CVE assigned
- 2026-06-01: advisory