Every CVE Search/ Get API key

CVE-2026-111487

Out-of-bounds write vulnerability in the assimp scene import plugin of Qt3D impacts Qt Framework

4.3 MediumFix available

An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Active

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
High

Exploit likelihood

0.12%Unchanged since Oct 31, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.3

Out-of-bounds write vulnerability in the assimp scene import plugin of Qt3D impacts Qt Framework

An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module.

Record
CVE-2026-111487
CVSS 4.0
4.3 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/R:U/RE:L/U:Amber
Weakness
CWE-787
Updated
2026-11-06
EUVDEUVD-2026-114086 4.3

An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module.

Record
EUVD-2026-114086
CVSS 4.0
4.3 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/R:U/RE:L/U:Amber
Updated
2026-11-06
GitHub AdvisoriesGHSA-43vc-wj6f-gcp8 4.3

An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D...

An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module.

Record
GHSA-43vc-wj6f-gcp8
CVSS 4.0
4.3 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:L/U:Amber
Weakness
CWE-787
Updated
2026-11-02
NVD 4.3

An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module.

Record
CVE-2026-111487
CVSS 4.0
4.3 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:L/U:Amber
Weakness
CWE-787
Updated
2026-11-06
OSVDEBIAN-CVE-2026-111487 4.3

An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module.

Record
DEBIAN-CVE-2026-111487
CVSS 4.0
4.3 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:L/U:Amber
Updated
2026-11-02
OSVUBUNTU-CVE-2026-111487 4.3

An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module.

Record
UBUNTU-CVE-2026-111487
CVSS 4.0
4.3 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/R:U/RE:L/U:Amber
Updated
2026-11-05
OSVopenSUSE-SU-2026:12383-1 No score

libQt63DAnimation6-6.12.0-2.1 on GA media

These are all security issues fixed in the libQt63DAnimation6-6.12.0-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12383-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
qt3d-opensource-src
Debian:12
 All versions, plus listed versions
5.15.10+dfsg-15.15.10+dfsg-25.15.12+dfsg-15.15.13+dfsg-15.15.13+dfsg-2
Show 11 moreShow less
5.15.13+dfsg-2+loong645.15.15+dfsg-15.15.15+dfsg-25.15.15+dfsg-35.15.17+dfsg-15.15.17+dfsg-25.15.18+dfsg-15.15.19+dfsg-15.15.19+dfsg-25.15.8+dfsg-25.15.9+dfsg-1
 None known
qt3d-opensource-src
Debian:13
 All versions, plus listed versions
5.15.15+dfsg-35.15.17+dfsg-15.15.17+dfsg-25.15.18+dfsg-15.15.19+dfsg-15.15.19+dfsg-2
 None known
qt3d-opensource-src
Debian:14
 All versions, plus listed versions
5.15.15+dfsg-35.15.17+dfsg-15.15.17+dfsg-25.15.18+dfsg-15.15.19+dfsg-15.15.19+dfsg-2
 None known
qt6-3d
Debian:12
 All versions, plus listed versions
6.10.2+dfsg-16.10.2+dfsg-26.10.2+dfsg-36.11.2+dfsg-16.11.2+dfsg-2
Show 20 moreShow less
6.4.2+dfsg-26.4.2+dfsg-36.4.2+dfsg-46.4.2+dfsg-56.4.2+dfsg-66.6.1+dfsg-16.6.1+dfsg-26.6.2+dfsg-16.6.2+dfsg-26.7.2+dfsg-16.7.2+dfsg-26.7.2+dfsg-36.7.2+dfsg-46.8.2+dfsg-16.8.2+dfsg-26.9.1+dfsg-16.9.1+dfsg-26.9.2+dfsg-16.9.2+dfsg-26.9.2+dfsg-3
 None known
qt6-3d
Debian:13
 All versions, plus listed versions
6.10.2+dfsg-16.10.2+dfsg-26.10.2+dfsg-36.11.2+dfsg-16.11.2+dfsg-2
Show 6 moreShow less
6.8.2+dfsg-26.9.1+dfsg-16.9.1+dfsg-26.9.2+dfsg-16.9.2+dfsg-26.9.2+dfsg-3
 None known
qt6-3d
Debian:14
 All versions, plus listed versions
6.10.2+dfsg-16.10.2+dfsg-26.10.2+dfsg-36.11.2+dfsg-16.11.2+dfsg-2
Show 6 moreShow less
6.8.2+dfsg-26.9.1+dfsg-16.9.1+dfsg-26.9.2+dfsg-16.9.2+dfsg-26.9.2+dfsg-3
 None known
qt3d-opensource-src
Ubuntu:16.04:LTS
 All versions, plus listed versions
5.0~git20130731-0ubuntu125.5.1-4ubuntu25.5.1-4ubuntu3
 None known
qt3d-opensource-src
Ubuntu:18.04:LTS
 All versions, plus listed versions
5.9.1+dfsg-35.9.2+dfsg-2build15.9.2+dfsg-35.9.3+dfsg-0ubuntu15.9.4+dfsg-0ubuntu25.9.5+dfsg-0ubuntu2
 None known
qt3d-opensource-src
Ubuntu:20.04:LTS
 All versions, plus listed versions
5.12.4+dfsg-15.12.5+dfsg-15.12.5+dfsg-1build15.12.5+dfsg-1build25.12.8+dfsg-0ubuntu1
 None known
qt3d-opensource-src
Ubuntu:22.04:LTS
 All versions, plus listed versions
5.15.2+dfsg-25.15.3+dfsg-1
 None known
Show 8 moreShow less
Affected packages
PackageAffectedFixed
qt6-3d
Ubuntu:22.04:LTS
 All versions, plus listed versions
6.2.2+dfsg-36.2.4+dfsg-1
 None known
qt3d-opensource-src
Ubuntu:24.04:LTS
 All versions, plus listed versions
5.15.10+dfsg-25.15.12+dfsg-15.15.12+dfsg-1build15.15.12+dfsg-1build25.15.13+dfsg-1
 None known
qt6-3d
Ubuntu:24.04:LTS
 All versions, plus listed versions
6.4.2+dfsg-66.4.2+dfsg-6build16.4.2+dfsg-6build26.4.2+dfsg-6build3
 None known
qt3d-opensource-src
Ubuntu:26.10
 All versions, plus listed versions
5.15.18+dfsg-1ubuntu15.15.19+dfsg-2
 None known
qt6-3d
Ubuntu:26.10
 All versions, plus listed versions
6.10.2+dfsg-16.10.2+dfsg-36.11.2+dfsg-1
 None known
qt3d-opensource-src
Ubuntu:26.04:LTS
 All versions, plus listed versions
5.15.17+dfsg-15.15.17+dfsg-2build15.15.18+dfsg-15.15.18+dfsg-1ubuntu1
 None known
qt6-3d
Ubuntu:26.04:LTS
 All versions, plus listed versions
6.9.2+dfsg-16.9.2+dfsg-1build16.10.2+dfsg-1
 None known
qt6-3d
openSUSE:Tumbleweed
 before 6.12.0-2.1
6.12.0-2.1

History

History
RecordedChangedSources
affected, aliases, facts, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-111487 is a medium vulnerability (CVSS 4.3) in Qt Framework, published October 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.12%, the 2nd percentile. Fixed in qt6-3d 6.12.0-2.1.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open