CVE-2026-111487

MediumCVSS 4.3

Published: 30/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 30/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

2th percentile - higher than 2% of all known CVEs

Summary

An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module. It may lead to memory corruption when processing a malicious scene file.

Risk Assessment

Processing a crafted scene file may crash the application or potentially allow code execution in the context of the processing process.

Recommendation

Upgrade the Qt Framework to a patched version and avoid importing untrusted scene files in applications using Qt3D.

Other vulnerabilities in Qt Framework

CVE-2025-14575Low
An Uncontrolled Search Path Element vulnerability in the OpenSSL TLS backend of Qt Network (qtbase) in Qt Framework (Unix) allows a local attacker to load a rogue CA certificate as a trusted system authority via a crafted certificate file placed in the application's working directory.

Original NVD description (English source)

An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS