4.3
MediumCVSS 4.0 · from Qt
CVE-2026-111487
Out-of-bounds write vulnerability in the assimp scene import plugin of Qt3D impacts Qt Framework
Qt Framework · Out-of-bounds write · CWE-787AffectedQt Framework
FixUpdate to 6.8.10, 6.11.3, 6.12.1 or newer
PublishedOct 30, 14:21 · Qt
ScoredOct 30 · 4.3 · Qt
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:06 UTC
What we know
No known exploitation. CISA KEV, checked 22:06 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs local access to the machine. CVSS: local.
Someone has to open, click or run something first. CVSS: user interaction required.
A successful attack can change data and take the service down. CVSS impact.
Description
An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module.
From Qt
Affected and fixed versions
ProductAffectedFixed inQt Framework6.5.0 – before 6.8.106.8.10Qt Framework6.9.0 – before 6.11.36.11.3Qt Framework6.12.0 – before 6.12.16.12.1
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known