CVE-2026-10232: Assimp ASE File scene.cpp ~aiNode use after free
A weakness has been identified in Assimp up to 6.0.4. Affected by this vulnerability is the function aiNode::~aiNode of the file scene.cpp of the component ASE File Parser. Executing a manipulation can lead to use after free. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. The project tagged the reported issue as bug.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Assimp (ASE File Parser)from your environment.Uninstall or remove the ASE file parser component (or uninstall Assimp if the library is not required) from affected systems to eliminate exposure to the vulnerable code.
- Configuration
If ASE file support is not required, disable the ASE importer or build Assimp without the ASE file parser to avoid executing the vulnerable aiNode::~aiNode code path.
Assimp (ASE File Parser) ASE file parsing support = disabled - Compensating control
Restrict local access to systems and accounts that can open or process ASE files; run applications that use Assimp in sandboxed or isolated environments and enforce least-privilege for local users to mitigate the locally‑launched exploit.
- Operational
Track the Assimp project for an upstream fix for the reported bug and plan to apply the vendor patch or updated release as soon as a fixed version is published; in the meantime, monitor systems for signs of exploitation.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10232?
The severity of CVE-2026-10232 is medium, rated at 5.3.
How do I fix CVE-2026-10232?
To fix CVE-2026-10232, update Assimp to version 6.0.5 or later.
What type of vulnerability is CVE-2026-10232?
CVE-2026-10232 is classified as a use after free vulnerability.
Is CVE-2026-10232 exploitable remotely?
No, CVE-2026-10232 requires local access to exploit.
What component is affected by CVE-2026-10232?
CVE-2026-10232 affects the aiNode::~aiNode function in the ASE File Parser of Assimp.