UBUNTU-CVE-2026-111487: Medium severity ubuntu/qt3d-opensource-src vulnerability
Published Nov 3, 2026
·Updated
An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module.
Affected Software
11 affected components
ubuntu/qt3d-opensource-src*
ubuntu/qt3d-opensource-src*
ubuntu/qt3d-opensource-src*
ubuntu/qt3d-opensource-src*
ubuntu/qt6-3d*
ubuntu/qt3d-opensource-src*
ubuntu/qt6-3d*
ubuntu/qt3d-opensource-src*
ubuntu/qt6-3d*
ubuntu/qt3d-opensource-src*
ubuntu/qt6-3d*
Event History
Nov 3, 2026
CVE Published
via OSV·12:00 AM
Data Sourced
via OSV·12:00 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Who is exposed to this issue?
Ubuntu systems using the Qt3D assimp scene import plugin through the qt3d-opensource-src or qt6-3d packages are in scope. Exploitation is local and does not require attacker privileges, but it requires user interaction.
2
What impact could successful exploitation have?
The available severity data indicates high impact to integrity and availability, with no indicated confidentiality impact. The issue is an out-of-bounds write.