CVE-2026-111487
Description
A flaw was found in the Qt3D module of the Qt framework. An out-of-bounds write vulnerability in the assimp scene import plugin allows an attacker to execute arbitrary code or cause a denial of service (DoS). By tricking a user into opening a specially crafted 3D scene file, an attacker can corrupt memory and trigger application crashes or unauthorized code execution.
Statement
An out-of-bounds write vulnerability in the Qt3D module's assimp scene import plugin allows an attacker to trigger an application crash or potentially execute arbitrary code by convincing a user to open a specially crafted 3D scene file.
Mitigation
Do not open untrusted 3D scene files in applications utilizing the Qt3D framework. Where 3D scene importing is not required, disable or remove the assimp scene parser plugin shared library (libassimpsceneimport.so) from the Qt plugins directory.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.8 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | Required | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
