Assimp EUVD-2026-96883

Exploitation requires that an application or service built on Assimp (versions up to 6.0.5) parse an attacker-controlled PLY-format model file through the PLY File Handler path that reaches IOStreamBuffer::getNextBlock. The key limiting factor is passive user interaction (UI:P in the vector): a victim must open, import, or otherwise cause the malicious PLY file to be processed - there is no fully automatic, zero-interaction network trigger unless a backend automatically ingests uploaded models. Impact is bounded to a memory-information leak and/or application crash; there is no indication of code execution. Authentication requirements are not independently confirmed - the supplied vector states PR:L (authenticated), but for a library that simply parses a supplied file this is likely overstated and real-world exploitation may require no privileges beyond delivering the file.

This is a low-to-moderate priority issue despite being remotely reachable. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L) yields only 5.1 (Medium), and the impact is uniformly Low across confidentiality, integrity, and availability, consistent with a CWE-125 out-of-bounds read that typically leaks small amounts of adjacent memory or crashes the host application rather than enabling code execution. No EPSS score was provided, the CVE is NOT on the CISA KEV list, and no public exploit code is referenced - so there is no signal of real-world exploitation. Two data points warrant scrutiny: (1) the vector marks UI:P (passive user interaction) which is appropriate for a file-parsing library, yet it also sets PR:L (privileges required), which is questionable for a library that merely parses an attacker-supplied PLY file - exploitation realistically needs no prior authentication, only that a victim application load a malicious file. (2) The vector assigns VI:L (integrity impact) even though an out-of-bounds READ does not modify data; integrity impact is likely overstated. Overall: a genuine but narrow-impact memory-safety bug, not an urgent threat.

An attacker crafts a malformed PLY 3D-model file that triggers the out-of-bounds read in IOStreamBuffer::getNextBlock and delivers it to a victim (e.g., via download, email, or an upload pipeline) whose application or service uses Assimp to import the model. When the file is parsed, the flaw causes an out-of-bounds read that can leak small amounts of adjacent process memory or crash the consuming application. No public proof-of-concept exploit is identified at time of analysis.