CVE-2026-111487

MediumCVSS 4.3/10Last modified Nov 6, 2026

Description

An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module.

Metrics

CVSS 4.0 4.3/10CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:L/U:Amber

Weakness enumeration

CWE-787

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
qtQt Framework>= 6.5.0, < 6.8.10; >= 6.9.0, < 6.11.3; >= 6.12.0, < 6.12.1

References

Timeline

Published
Oct 30, 2026
Last modified
Nov 6, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1114899.9A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform. The report staCVE-2026-111497.5Insufficient validation of untrusted input in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromisCVE-2026-1114909.9Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the `actingasuser` HTTP header without verifyinCVE-2026-1114916.9Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences. An attacker with access toCVE-2026-1114928.6SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase Cloud Messaging and conCVE-2026-1114938.7Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be downloaded using prediCVE-2026-1114949.1Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hCVE-2026-1114955.1API keys, credentials, and configuration parameters embedded in the MatchPoint APK, which can be extracted through reverse engineering. The CVE-2026-1114969.1Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next() computed the next punctuation time as timestaCVE-2026-1114979.8A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allowsCVE-2026-1114984.4OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Resource Locking vulnerability. A high privileged attacker with local aCVE-2026-1114995.5Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low
CVE-2026-111487: Medium severity, CVSS 4.3 | Vulnix