Read the docs
TI-2026-83113 Aliases CVE-2026-111487GHSA-43vc-wj6f-gcp8

Out-of-bounds write in Qt Framework's Qt3D assimp scene import plugin

Priority LOW 19CWE-787Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Partial Red Hat: 1 fixed, 5 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

Qt Framework from 6.5.0 before 6.8.10, from 6.9.0 before 6.11.3 and from 6.12.0 before 6.12.1 is affected. The assimp scene import plugin of the Qt3D module has an out-of-bounds write (CWE-787) that writes memory outside the intended bounds. A local user with no privileges can corrupt memory if a user interacts with the application, which affects integrity and availability.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00125 2nd percentileScored 2026-11-07
Fix Partial Qt Framework (qt): 6.8.10, 6.11.3, 6.12.1Red Hat: 1 advisoryRed Hat: 1 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
qtQt Framework6.5.0 to before 6.8.10; 6.9.0 to before 6.11.3; 6.12.0 to before 6.12.16.8.10, 6.11.3, 6.12.1Patch availableCNA
  • Qt Framework Vendorqt Affected 6.5.0 to before 6.8.10; 6.9.0 to before 6.11.3; 6.12.0 to before 6.12.1 Fixed in 6.8.10, 6.11.3, 6.12.1 Patch available CNA

CPE names CNA · 2

CPEVersionsRoleVendor
cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*——qt
cpe:2.3:a:qt:qt3d:*:*:*:*:*:*:*:*——qt
  • cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:* Versions — — ·qt
  • cpe:2.3:a:qt:qt3d:*:*:*:*:*:*:*:* Versions — — ·qt

Remediation

Update Qt Framework to 6.8.10, 6.11.3 or 6.12.1. Red Hat Hardened Images is fixed by RHSA-2026:80566. Red Hat lists no available fix for Red Hat Enterprise Linux 10, 7, 8 and 9.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

  • Fix · CNA Qt Framework (qt) Fixed in 6.8.10, 6.11.3, 6.12.1

Red Hat 1 advisory

  • RHSA-2026:80566 Released 2026-10-12 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images qt5-5.15.18-3.1.hum1@src, qt5-filesystem-5.15.18-3.1.hum1@aarch64, qt5-filesystem-5.15.18-3.1.hum1@s390x +7

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 7AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Hardened ImagesAffectedNo fix yet
Red Hat Hardened ImagesFixed RHSA-2026:80566

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-111487
  2. 2026-10-30 Alias added: GHSA-43vc-wj6f-gcp8
  3. 2026-10-30 Affected versions changed · Red Hat
  4. 2026-10-30 CVSS score added · Red Hat
  5. 2026-10-31 Fix available: RHSA-2026:80566 · Red Hat
  6. 2026-10-31 Fix available: Red Hat Hardened Images · Red Hat
  7. 2026-11-02 Affected versions changed · Red Hat
  8. 2026-11-06 CISA SSVC decision points changed

References

Patch 1

Advisory 1

  • TI-2024-23902 QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x… CVSS 3.1CRITICAL 9.8
  • TI-2022-21359 Heap-based buffer overflow in Qt CVSS 3.1HIGH 8.8
  • TI-2022-19524 Integer overflow in Qt CVSS 3.1HIGH 8.8
  • TI-2023-18997 In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can… CVSS 3.1HIGH 7.5
  • TI-2021-09305 Integer Overflow vulnerability in qsvghandler.cpp in Qt qtsvg versions 5.15.1, 6.0.0… CVSS 3.1MEDIUM 5.5
  • TI-2023-28356 An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before… CVSS 3.1CRITICAL 9.8
See all 106 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences