Qt3D Assimp Plugin Vulnerability Affects Qt Versions 5.9 Through 6.12
An out-of-bounds write flaw in the Qt3D assimp plugin impacts multiple Qt 5 and 6 releases, with patches currently available via the Qt code review system.
CVE-2026-111487 is an out-of-bounds write vulnerability in the Qt3D assimp scene import plugin, published by the Qt Project and authored by Joni Poikelin on October 30, 2026.
The flaw impacts Qt versions 5.9.0 through 6.8.9, 6.9.0 through 6.11.2, and Qt 6.12.0. Triggering it requires importing a specially crafted 3D asset, which can lead to an application crash or memory integrity issues. CVSS 4.0 rates the vulnerability at 4.3 Medium, citing a local attack vector requiring no privileges but needing user interaction, high impact on integrity and availability, and unreported exploit maturity.
Patched versions—Qt 6.8.10, Qt 6.11.3, Qt 6.12.1, and Qt 6.13.0—are not yet released. Meanwhile, patches are available from the Qt code review system for the dev branch, Qt 6.12, and Qt 6.8, with the 6.12 and 6.8 patches also downloadable as diff files from Qt servers.
Until you update, you should stop importing 3D asset files from untrusted sources via the plugin. If your applications allow users to load models or scenes, or automatically pull in third-party assets, verify whether they use the plugin.
Qt also published CVE-2026-107457, a memory corruption bug in QMqttClient, and CVE-2026-105924, a NULL pointer dereference in QCborValue to JSON conversion.