CVE-2026-108573: Out-of-Bounds Read in Open Asset Import Library Assimp

The vulnerability CVE-2026-108573 affects Open Asset Import Library Assimp up to version 6.0.5. It is caused by an out-of-bounds read in the IOStreamBuffer::getNextBlock function of the PLY File Handler component. An attacker can remotely manipulate input to trigger this flaw. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity, with network attack vector, low complexity, low privileges required, and partial user interaction. The vendor was contacted but did not provide any response or patch information.

Successful exploitation of this vulnerability could lead to out-of-bounds memory reads, potentially causing application crashes or information disclosure. The attack can be initiated remotely with low privileges and partial user interaction, but the impact is limited to low confidentiality, integrity, and availability impacts as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider avoiding processing untrusted PLY files or apply additional input validation and sandboxing measures until a patch is released.