Qt3D CVE-2026-111487

Exploitation requires the affected application to use the Qt3D module's assimp scene import plugin and the victim to actively open or import an attacker-supplied malicious 3D scene/model file (UI:A). The vector is local (AV:L), not remote-network, and attack complexity is low (AC:L) with no special attack requirements (AT:N). Limiting factors: the target application must actually build in and invoke the Qt3D assimp import path, and a user must be induced to import the crafted file, so there is no autonomous or unattended exploitation. Impact is to integrity and availability only (VC:N), so no direct data disclosure results.

This is a moderate, not urgent, issue. The single CVSS 4.0 vector supplied (base score 4.3) is internally consistent with the description: AV:L with UI:A means exploitation is local and requires a victim to actively open or import a file, not a remotely triggerable network flaw; VC:N/VI:H/VA:H indicates integrity and availability impact (consistent with an out-of-bounds write / memory corruption) but no confidentiality exposure. The threat metrics in the same vector reinforce low real-world urgency: E:U (exploit maturity unproven) means no exploit is attested, and the vuln.today Decision label is 'this_month' rather than act_now or emergency. No EPSS score, no CISA KEV listing, and no PoC reference were provided, so there is no signal of active or imminent exploitation - this reads as a vendor-self-reported (reported by Qt) memory-safety bug patched proactively rather than a widespread threat. Note a minor tension to verify: PR:N in the vector denotes no privileges, but exploitation still depends entirely on tricking a user into importing a malicious scene file, so the practical barrier is the required user interaction, not authentication.

An attacker crafts a malformed 3D model/scene file and delivers it to a victim (e.g., via email, download, or a shared asset repository). When the victim opens or imports that file into an application built on Qt that uses the Qt3D assimp scene import plugin, the out-of-bounds write corrupts memory, potentially crashing the application or corrupting data in the process. Given the local vector and required user interaction (AV:L/UI:A), exploitation hinges on social engineering to get the file opened; no public exploit is identified at time of analysis.