CVE-2026-10232: Use After Free in Assimp
A weakness has been identified in Assimp up to 6.0.4. Affected by this vulnerability is the function aiNode::~aiNode of the file scene.cpp of the component ASE File Parser. Executing a manipulation can lead to use after free. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. The project tagged the reported issue as bug.
AI Analysis
Technical Summary
This vulnerability affects Assimp versions 6.0.0 through 6.0.4 in the aiNode::~aiNode function of the ASE File Parser component (scene.cpp). It is a use-after-free flaw that can be triggered by local manipulation. The vulnerability has been publicly disclosed, and an exploit is available, but it requires local privileges to execute. The CVSS 4.0 vector indicates low attack complexity, local attack vector, and no user interaction needed, with limited confidentiality, integrity, and availability impact. There is no vendor advisory or patch information provided, and the project has tagged the issue as a bug.
Potential Impact
The vulnerability could allow an attacker with local access to cause a use-after-free condition, potentially leading to application crashes or undefined behavior. The impact is limited due to the requirement for local access and the medium CVSS score. There is no indication of remote exploitation or elevated privileges from the provided data.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided and the remediation level is null, users should monitor the Assimp project for updates. Until a patch is available, restrict local access to trusted users and environments to reduce risk.
CVE-2026-10232: Use After Free in Assimp
Description
A weakness has been identified in Assimp up to 6.0.4. Affected by this vulnerability is the function aiNode::~aiNode of the file scene.cpp of the component ASE File Parser. Executing a manipulation can lead to use after free. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. The project tagged the reported issue as bug.
CVSS v4.0
Score 4.8medium
Affected software
pkg:github/assimp/assimpRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects Assimp versions 6.0.0 through 6.0.4 in the aiNode::~aiNode function of the ASE File Parser component (scene.cpp). It is a use-after-free flaw that can be triggered by local manipulation. The vulnerability has been publicly disclosed, and an exploit is available, but it requires local privileges to execute. The CVSS 4.0 vector indicates low attack complexity, local attack vector, and no user interaction needed, with limited confidentiality, integrity, and availability impact. There is no vendor advisory or patch information provided, and the project has tagged the issue as a bug.
Potential Impact
The vulnerability could allow an attacker with local access to cause a use-after-free condition, potentially leading to application crashes or undefined behavior. The impact is limited due to the requirement for local access and the medium CVSS score. There is no indication of remote exploitation or elevated privileges from the provided data.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided and the remediation level is null, users should monitor the Assimp project for updates. Until a patch is available, restrict local access to trusted users and environments to reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-05-31T08:11:02.037Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a1de30ee29bf47b503a5802
Added to database: 06/01/2026, 19:52:46 UTC
Last enriched: 06/08/2026, 20:47:12 UTC
Last updated: 07/31/2026, 19:22:57 UTC
Views: 83
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.