CVE-2026-14610

A flaw was found in Open Asset Import Library Assimp. This vulnerability, a heap-based buffer overflow, allows a local attacker to manipulate input when processing CSM files. Successful exploitation could lead to information disclosure, compromise of data integrity, or a denial of service (DoS).

A heap-based buffer overflow in the Open Asset Import Library (Assimp) allows a local attacker to cause information disclosure and a denial of service by processing a specially crafted CSM file. Exploitability is limited by the requirement for local system access.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not process Character Studio Motion (.csm) files from untrusted sources. If CSM support is not required, mitigate the flaw by rebuilding Assimp with the ASSIMP_BUILD_NO_CSM_IMPORTER flag enabled, or by configuring Qt 3D and Qt Quick 3D to block .csm asset imports at the application level.