---
id: CVE-2026-111487
title: >-
  Out-of-bounds write vulnerability in the assimp scene import plugin of Qt3D
  impacts Qt Framework
summary: >-
  An out-of-bounds write vulnerability in the Qt Framework assimp scene import
  plugin of the Qt3D module.
severity: medium
cvss: 4.3
cvssVector: >-
  CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/R:U/RE:L/U:Amber
cvssSource: cna
cwe:
  - CWE-787
vendor: qt
product: Qt Framework
affected:
  - framework >= 6.5.0 < 6.8.10
  - framework >= 6.9.0 < 6.11.3
  - framework >= 6.12.0 < 6.12.1
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T14:21:23.428Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111487'
references:
  - url: >-
      https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-111487
    label: 'Qt Wiki: List of known vulnerabilities in Qt products'
  - url: 'https://codereview.qt-project.org/c/qt%2Fqt3d/+/777981'
    label: Qt3D patch (dev)
tags:
  - cve.org
epss: 0.00125
epssPercentile: 0.02241
ingestedAt: '2026-11-05T16:07:30.301Z'
---

## Overview

An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module.

## Affected

- `framework >= 6.5.0 < 6.8.10`
- `framework >= 6.9.0 < 6.11.3`
- `framework >= 6.12.0 < 6.12.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.