CVE-2026-111487

A flaw was found in the Qt3D module of the Qt framework. An out-of-bounds write vulnerability in the assimp scene import plugin allows an attacker to execute arbitrary code or cause a denial of service (DoS). By tricking a user into opening a specially crafted 3D scene file, an attacker can corrupt memory and trigger application crashes or unauthorized code execution.

An out-of-bounds write vulnerability in the Qt3D module's assimp scene import plugin allows an attacker to trigger an application crash or potentially execute arbitrary code by convincing a user to open a specially crafted 3D scene file.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not open untrusted 3D scene files in applications utilizing the Qt3D framework. Where 3D scene importing is not required, disable or remove the assimp scene parser plugin shared library (libassimpsceneimport.so) from the Qt plugins directory.