Log in Start free

Vulnerability · Published Oct 30, 2026 · Assigned by Qt

CVE-2026-111487Out-of-bounds write vulnerability in the assimp scene import plugin of Qt3D impacts Qt Framework

Medium 4.3

In plain English

A medium-severity out-of-bounds write in Qt Framework from qt. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).

Severity (CVSS 4.0)4.3Medium
Exploit odds (30 days)0.1%top 97.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12qt3d-opensource-srcno fix listedDEBIAN-CVE-2026-111487
Debian:13qt3d-opensource-srcno fix listedDEBIAN-CVE-2026-111487
Debian:14qt3d-opensource-srcno fix listedDEBIAN-CVE-2026-111487
Debian:12qt6-3dno fix listedDEBIAN-CVE-2026-111487
Debian:13qt6-3dno fix listedDEBIAN-CVE-2026-111487
Debian:14qt6-3dno fix listedDEBIAN-CVE-2026-111487
Ubuntu:22.04:LTSqt3d-opensource-srcno fix listedUBUNTU-CVE-2026-111487
Ubuntu:24.04:LTSqt3d-opensource-srcno fix listedUBUNTU-CVE-2026-111487
Ubuntu:26.04:LTSqt3d-opensource-srcno fix listedUBUNTU-CVE-2026-111487
Ubuntu:26.10qt3d-opensource-srcno fix listedUBUNTU-CVE-2026-111487
Ubuntu:22.04:LTSqt6-3dno fix listedUBUNTU-CVE-2026-111487
Ubuntu:24.04:LTSqt6-3dno fix listedUBUNTU-CVE-2026-111487
Ubuntu:26.04:LTSqt6-3dno fix listedUBUNTU-CVE-2026-111487
Ubuntu:26.10qt6-3dno fix listedUBUNTU-CVE-2026-111487

Affected products (as reported)

VendorProductVersions
qt Qt Framework 6.5.0 – before 6.8.106.9.0 – before 6.11.36.12.0 – before 6.12.1

Weakness: CWE-787 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/R:U/RE:L/U:Amber

References