Is CVE-2026-14604 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14604 being exploited in the wild.

How severe is CVE-2026-14604?

Medium severity, with a CVSS score of 6.3, published 3 July 2026.

Which products and versions are affected?

Assimp Open Asset Import Library up to 6.0.4.

Is there a fix for CVE-2026-14604?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-14604 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-14604?

Check whether you run Assimp Open Asset Import Library at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14604: Open Asset Import Library Assimp double free in PLY Model Handler

CVE-2026-14604 · Severity: medium · CVSS 6.3 · Published 2026-07-03

Assimp is a widely used library for importing and exporting 3D model formats. A vulnerability has been identified in how the library handles PLY model files, which could allow an attacker to crash applications using the library or potentially execute unauthorized code. This could lead to service disruptions or data integrity issues for systems processing untrusted 3D assets.

Technologies: Assimp Open Asset Import Library. Vendors: Assimp.

Quick answers

Is CVE-2026-14604 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14604 being exploited in the wild.
How severe is CVE-2026-14604?: Medium severity, with a CVSS score of 6.3, published 3 July 2026.
Which products and versions are affected?: Assimp Open Asset Import Library up to 6.0.4.
Is there a fix for CVE-2026-14604?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-14604 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-14604?: Check whether you run Assimp Open Asset Import Library at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A double-free vulnerability (CWE-415) exists in Assimp up to version 6.0.4. The issue is located in the Assimp::Exporter::ExportToBlob function within code/AssetLib/Ply/PlyLoader.cpp, specifically affecting the PLY Model Handler component. An attacker can trigger this memory corruption by providing a specially crafted PLY model file for processing. While the attack requires low privileges, it can be initiated remotely. A public proof-of-concept exploit has been disclosed, increasing the risk of utilization. The vulnerability was reported via the project's GitHub issue tracker.

Affected products

Open Asset Import Library Assimp up to 6.0.4

Timeline

2026-07-03: advisory: NVD publication date
2026-07-03: disclosed: Public disclosure of the vulnerability and proof-of-concept

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.