Is there a public PoC exploit available for CVE-2026-14604?

Yes, a public proof-of-concept exploit is available for CVE-2026-14604. Prioritise patching immediately. EPSS: 0.2%.

Assimp CVE-2026-14604

Q: What is the CVSS score of CVE-2026-14604?

CVE-2026-14604 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-41561 LOW

Double Free (CWE-415)

2026-07-03 VulDB

GHSA-vxfh-hphw-q23h

Information Disclosure Assimp Open Asset Import Library

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-reachable via crafted PLY file submission, low-privilege access gate required, no scope change, and limited C/I/A impact consistent with a double-free heap corruption without confirmed code execution.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 03, 2026 - 19:22 NVD

MEDIUM LOW

CVSS changed

Jul 03, 2026 - 19:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jul 03, 2026 - 19:21 vuln.today

DescriptionCVE.org

A vulnerability was determined in Open Asset Import Library Assimp up to 6.0.4. Affected is the function Assimp::Exporter::ExportToBlob of the file code/AssetLib/Ply/PlyLoader.cpp of the component PLY Model Handler. This manipulation causes double free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report.

AnalysisAI

Double-free heap corruption in Open Asset Import Library (Assimp) through version 6.0.4 allows remote low-privileged attackers to corrupt process memory by supplying a maliciously crafted PLY 3D model file to the ExportToBlob function in the PLY Model Handler. A publicly available proof-of-concept exploit was disclosed alongside the report. The CVSS 4.0 score of 5.3 (Medium) reflects limited confidentiality, integrity, and availability impact on the vulnerable system, though CWE-415 double-free conditions in C++ libraries carry latent potential for escalated impact depending on memory layout and heap state at runtime.

Technical ContextAI

Assimp (Open Asset Import Library, cpe:2.3:a:open_asset_import_library:assimp:*:*:*:*:*:*:*:*) is a widely deployed C++ library used by game engines, 3D tools, and rendering pipelines to import and export dozens of 3D model formats. The vulnerability resides in the PLY (Polygon File Format) handler component, specifically in the Assimp::Exporter::ExportToBlob function within code/AssetLib/Ply/PlyLoader.cpp. CWE-415 (Double Free) occurs when the same heap-allocated memory region is freed more than once - in C++ this corrupts the heap allocator's internal metadata structures (e.g., glibc bin pointers or tcache entries), potentially enabling an attacker to influence subsequent allocations and overwrite arbitrary memory. Although the assessed impact is bounded to VC:L/VI:L/VA:L in the provided CVSS 4.0 vector, double-free primitives are well-understood exploitation targets: skilled attackers can often escalate them beyond the initial disclosure or crash depending on the allocator version and runtime heap state of the embedding application.

RemediationAI

No vendor-released patched version has been confirmed at time of analysis - fix availability should be monitored via the upstream GitHub issue at https://github.com/assimp/assimp/issues/6620 and the VulDB advisory at https://vuldb.com/cve/CVE-2026-14604. As an immediate compensating control, applications accepting PLY files from untrusted sources should disable PLY format support at Assimp build time (by excluding the PLY importer/exporter) if that format is not operationally required - this eliminates the attack surface with no functional trade-off for non-PLY pipelines. Where PLY support is required, sandboxing the Assimp processing worker via seccomp-bpf, containers, or OS-level process isolation limits blast radius of successful heap corruption to the sandboxed process. Input validation of file structure before passing to Assimp provides marginal defense but is insufficient alone given that malformed content is the attack vehicle. Apply the official patch immediately upon release.