Out-of-Bounds Write Vulnerability in Qt Framework's Assimp Scene Import Plugin
CVE-2026-111487

4.3MEDIUM

Key Information:

Vendor

Qt

Status
Qt Framework
Vendor
CVE Published:
30 October 2026

What is CVE-2026-111487?

An out-of-bounds write vulnerability has been identified in the Assimp scene import plugin of the Qt3D module within the Qt Framework. This flaw could potentially allow an attacker to exploit memory corruption, potentially leading to unexpected behavior or crashes in applications using this module. Developers and users utilizing the affected versions should assess their environments to mitigate possible impacts and apply relevant patches as per vendor advisories.

Affected Version(s)

Qt Framework 6.5.0 < 6.8.10

Qt Framework 6.9.0 < 6.11.3

Qt Framework 6.12.0 < 6.12.1

References

https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_pr...
vendor-advisory
https://codereview.qt-project.org/c/qt%2Fqt3d/+/777981
patch

CVSS V4

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bruno Fournier
.