EUVD-2026-33565
GHSA-7vqg-xr22-fvmv
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in Assimp up to 6.0.4. Affected by this vulnerability is the function aiNode::~aiNode of the file scene.cpp of the component ASE File Parser. Executing a manipulation can lead to use after free. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. The project tagged the reported issue as bug.
AnalysisAI
Use-after-free in Assimp's ASE File Parser - specifically the aiNode::~aiNode destructor in scene.cpp - allows a local, low-privileged attacker to corrupt heap memory, potentially causing denial of service or achieving arbitrary code execution in applications that load 3D model files. All Assimp versions through 6.0.4 are affected. A public proof-of-concept exploit (poc.zip) has been disclosed via GitHub, reducing the skill barrier for exploitation in environments where untrusted ASE-format files can be submitted for processing. No public exploit identified as confirmed actively exploited (CISA KEV) at time of analysis.
Technical ContextAI
Assimp (Open Asset Import Library) is a widely-used open-source C++ library for importing and processing 3D model file formats, embedded in game engines, 3D editors, asset pipelines, and visualization tools. The vulnerability is located in the ASE (ASCII Scene Export) file parser, in the destructor aiNode::~aiNode within scene.cpp. CWE-416 (Use After Free) describes a condition where heap memory is accessed after the allocator has reclaimed it; in a destructor context this commonly occurs when object ownership or lifetime is mismanaged during tree teardown, such as a child node being freed and then referenced again as the parent destructor unwinds. The CPE string cpe:2.3:a:n/a:assimp:*:*:*:*:*:*:*:* covers all tracked Assimp releases up to 6.0.4 with no vendor namespace assigned in NVD, which may reflect the library's independent open-source status. Tags confirm the observable impacts include memory corruption and denial of service.
RemediationAI
No vendor-released patch version has been confirmed from available references at time of analysis - the CVSS temporal remediation level is explicitly marked as not defined (RL:X), and the upstream GitHub issue (#6617) does not indicate a tagged fixed release. Until a patch is available, the primary compensating control is to disable or restrict processing of ASE-format files if the application does not require that specific format, directly eliminating exposure to the vulnerable parser path (trade-off: loss of ASE format support). Where ASE processing cannot be disabled, sandboxing the Assimp parsing process in an isolated low-privilege container or subprocess limits the blast radius of exploitation to the sandbox rather than the host process (trade-off: added architectural complexity). Input validation to reject malformed or unexpected ASE files at the application boundary may reduce crash frequency but is not a reliable security control against a crafted exploit. Monitor https://github.com/assimp/assimp/issues/6617 and https://vuldb.com/cve/CVE-2026-10232 for upstream patch availability.
An issue in assimp v.5.4.3 allows a local attacker to execute arbitrary code via the CallbackToLogRedirector function wi
Open Asset Import Library (assimp) commit 3c253ca was discovered to contain a segmentation violation via the component A
A heap-buffer-overflow vulnerability was discovered in the SkipSpacesAndLineEnd function in Assimp v5.4.3. Rated medium
A segmentation fault (SEGV) was detected in the SortByPTypeProcess::Execute function in the Assimp library during fuzz t
A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode function within the
A heap-buffer-overflow vulnerability has been identified in the OpenDDLParser::parseStructure function within the Assimp
A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. Rated medium severity (CV
A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic.h of the component CSM
A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. Rated medium severity (
A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3.cpp. Rated m
A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. Rated medium severity (CVSS
A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. Rated medium severity (
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today