Description
A vulnerability was detected in Open Asset Import Library Assimp up to 6.0.5. Affected by this vulnerability is the function IOStreamBuffer::getNextBlock of the component PLY File Handler. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-10-11
Score: 5.1 Medium
EPSS: n/a
KEV: No
Impact: Out-of-bounds read vulnerability leading to potential information disclosure or crash
Action: Apply Patch
AI Analysis

Impact

The function IOStreamBuffer::getNextBlock in the PLY File Handler of the Open Asset Import Library contains a flaw that permits an out‑of‑bounds read. When a maliciously crafted PLY file is parsed, data outside the intended buffer can be read, potentially revealing internal memory contents or causing a crash. The vulnerability does not provide direct code execution but may degrade confidentiality or availability of a system processing such files.

Affected Systems

Vendors affected are the Open Asset Import Library:Assimp up to and including version 6.0.5. Any build of Assimp that includes the susceptible PLY file handler component should be considered vulnerable.

Risk and Exploitability

The CVSS score of 5.1 indicates a medium severity vulnerability. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. The attack is inferred to be remote through delivery of a crafted PLY file, possibly embedded in data processed by the library. Proper safeguards and monitoring of file inputs are recommended to mitigate risk.

Generated by OpenCVE AI on October 11, 2026 at 12:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Assimp to version 6.0.6 or later to remove the vulnerable getNextBlock implementation
  • If an update cannot be applied immediately, disable processing of PLY files or reject untrusted PLY inputs via application logic
  • Implement input validation or sandboxing around the Assimp parser to contain potential memory‑access violations

Generated by OpenCVE AI on October 11, 2026 at 12:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 11 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in Open Asset Import Library Assimp up to 6.0.5. Affected by this vulnerability is the function IOStreamBuffer::getNextBlock of the component PLY File Handler. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Title Open Asset Import Library Assimp PLY File getNextBlock out-of-bounds
First Time appeared Assimp
Assimp assimp
Weaknesses CWE-119
CWE-125
CPEs cpe:2.3:a:assimp:assimp:*:*:*:*:*:*:*:*
Vendors & Products Assimp
Assimp assimp
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:C'}

cvssV3_0

{'score': 5.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C'}

cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Assimp Assimp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-11T11:15:19.326Z

Reserved: 2026-10-10T15:27:54.409Z

Link: CVE-2026-108573

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-11T12:16:52.783

Modified: 2026-10-11T12:16:52.783

Link: CVE-2026-108573

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-11T12:30:18Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-125

    Out-of-bounds Read