The vulnerability arises from a double‑free condition in the ExportToBlob function of Assimp’s PlyLoader.cpp. Manipulation of a PLY model can cause the program to release the same memory block twice, corrupting heap data. Such corruption could lead to unexpected program termination or, if an attacker can control the payload leveraged to overwrite data or execute malicious code, though the CVE description does not expressly confirm arbitrary execution.

Any software that integrates Open Asset Import Library Assimp version 6.0.4 or earlier and uses the PLY Model Handler’s ExportToBlob routine is affected. Applications that import or export PLY files or explicitly invoke ExportToBlob are at risk; code paths that never trigger this function or do not handle PLY files are not impacted by the described flaw.

The CVSS score of 5.3 indicates a moderate severity, reflecting the potential for remote exploitation as stated in the CVE description. The EPSS score is 0.00233, indicating a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, yet the issue has been publicly disclosed and can be triggered remotely through untrusted PLY data. Deployments that accept external PLY files are therefore exposed to the risk of denial of service or potential exploitation, pending availability of a vendor patch.