Qt Framework
Monthly
Qt3D's assimp scene import plugin contains an out-of-bounds write (CWE-787) that corrupts memory when a crafted 3D scene/model file is imported, giving Integrity and Availability impact while leaving Confidentiality unaffected. The attack is local (AV:L), low complexity, requires no privileges, and depends on the victim actively opening a malicious asset (UI:A), so exposure is limited to applications that build and invoke the Qt3D assimp import path. A vendor patch is available via the Qt3D Gerrit change referenced in the Qt advisory; no public exploit code or CISA KEV entry is associated with this CVE at time of analysis, and the issue is rated moderate and non-urgent with a this_month remediation priority.
Qt3D's assimp scene import plugin contains an out-of-bounds write (CWE-787) that corrupts memory when a crafted 3D scene/model file is imported, giving Integrity and Availability impact while leaving Confidentiality unaffected. The attack is local (AV:L), low complexity, requires no privileges, and depends on the victim actively opening a malicious asset (UI:A), so exposure is limited to applications that build and invoke the Qt3D assimp import path. A vendor patch is available via the Qt3D Gerrit change referenced in the Qt advisory; no public exploit code or CISA KEV entry is associated with this CVE at time of analysis, and the issue is rated moderate and non-urgent with a this_month remediation priority.