Executive brief
Assimp is a widely used library for importing and exporting 3D model formats. A vulnerability has been identified in how the library handles PLY model files, which could allow an attacker to crash applications using the library or potentially execute unauthorized code. This could lead to service disruptions or data integrity issues for systems processing untrusted 3D assets.
Technical details
A double-free vulnerability (CWE-415) exists in Assimp up to version 6.0.4. The issue is located in the Assimp::Exporter::ExportToBlob function within code/AssetLib/Ply/PlyLoader.cpp, specifically affecting the PLY Model Handler component. An attacker can trigger this memory corruption by providing a specially crafted PLY model file for processing. While the attack requires low privileges, it can be initiated remotely. A public proof-of-concept exploit has been disclosed, increasing the risk of utilization. The vulnerability was reported via the project's GitHub issue tracker.
Affected products
- Open Asset Import Library Assimp up to 6.0.4
Timeline
- 2026-07-03: advisory: NVD publication date
- 2026-07-03: disclosed: Public disclosure of the vulnerability and proof-of-concept