Is CVE-2026-111487 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111487 being exploited in the wild.

How severe is CVE-2026-111487?

Informational severity, published 30 October 2026.

Is there a fix for CVE-2026-111487?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-111487 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-111487?

Check whether you run Qt Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111487: Qt Framework out-of-bounds write in Qt3D assimp plugin

CVE-2026-111487 · Severity: info · Published 2026-10-30

The Qt Framework's Qt3D module includes an assimp scene import plugin used by applications to load 3D model files. An out-of-bounds write vulnerability in this plugin could allow an attacker to crash an application or potentially execute code by providing a malicious 3D scene file. Applications that use Qt3D to load untrusted 3D models are at risk.

Technologies: Qt Framework. Vendors: Qt.

Quick answers

Is CVE-2026-111487 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111487 being exploited in the wild.
How severe is CVE-2026-111487?: Informational severity, published 30 October 2026.
Which products and versions are affected?: Qt Framework qt3d module.
Is there a fix for CVE-2026-111487?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-111487 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-111487?: Check whether you run Qt Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds write vulnerability exists in the assimp scene import plugin of Qt3D, triggered when processing specially crafted 3D scene files. The vulnerability occurs in the plugin's file parsing logic and can be exploited by supplying a malicious scene file to an application using Qt3D. Successful exploitation may lead to application crash or code execution, depending on memory layout and compiler behavior.

Affected products

Qt Qt Framework qt3d module

Timeline

2026-10-30: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.