A vulnerability was detected in Open Asset Import Library Assimp up to 6.0.5. (CVE-2026-108573)

CVE-2026-108573 describes an out-of-bounds read vulnerability in the IOStreamBuffer::getNextBlock function within the PLY File Handler component of Open Asset Import Library Assimp versions up to 6.0.5. The vulnerability allows remote attackers to cause an out-of-bounds read by manipulating input processed by this function. The vendor was contacted but did not provide any response or patch information. The CVSS 3.1 base score is 5.5, indicating medium severity, with attack vector network, low attack complexity, requiring privileges and user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could lead to information disclosure, integrity loss, and availability impact due to out-of-bounds memory reads. The attack can be initiated remotely but requires user interaction and some privileges. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are available, users should monitor for official updates and consider applying any future patches promptly. Until a fix is available, avoid processing untrusted PLY files with affected versions of Assimp.