CVE-2026-14604 Open Asset Import Library Assimp PLY Model PlyLoader.cpp ExportToBlob double free
A double free vulnerability in Assimp's PLY loader allows remote attackers to cause denial of service or potentially execute arbitrary code via crafted files.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-14604?
CVE-2026-14604 is a medium-severity use after free vulnerability in Open Asset Import Library Assimp, published on 3 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability was determined in Open Asset Import Library Assimp up to 6.0.4. Affected is the function Assimp::Exporter::ExportToBlob of the file code/AssetLib/Ply/PlyLoader.cpp of the component PLY Model Handler. This manipulation causes double free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report.
Which versions are affected by CVE-2026-14604?
How do I fix CVE-2026-14604?
No fix has been published for CVE-2026-14604 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-14604 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-14604 exists.
Sources
Also known as DEBIAN-CVE-2026-14604, GHSA-vxfh-hphw-q23h, UBUNTU-CVE-2026-14604.