A use‑after‑free weakness has been identified in the Assimp library, affecting releases up to 6.0.4. The defect is located in the destructor of the aiNode class within the ASE file parser module (scene.cpp). When parsing an ASE file, the destructor incorrectly accesses memory that has already been freed, enabling a local attacker to manipulate program execution or cause a crash. The description explicitly notes that the issue can lead to use after free and that an exploit has been publicly released.

The vulnerability impacts any installation of Assimp version 6.0.4 or earlier that uses the ASE file parser to load asset files. Assimp is commonly embedded in gaming, simulation, and content creation applications. Users should check the version of the library they depend on and determine whether the ASE import functionality is in use.

The CVSS score of 4.8 places this defect in the medium severity range. Because the exploit is local and requires a crafted ASE file, attackers must have the ability to supply malicious files to the affected application. The EPSS score of < 1% indicates a very low exploitation probability, and the vulnerability is not listed in CISA KEV, suggesting limited public exploitation. Nonetheless, in environments where untrusted ASE files are processed, the risk of memory corruption or program instability remains.