Qt Framework out-of-bounds write in Qt3D assimp plugin listed as EUVD-2026-114086
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Qt
- Product
- Qt Framework
- First seen
Summary
The EUVD record EUVD-2026-114086 describes an out-of-bounds write vulnerability in the assimp scene import plugin of the Qt3D module in Qt Framework, with a CVSS v3.1 score of 4.3. The record does not list affected versions in the captured text.
If you use Qt
Check the Qt advisory for affected and fixed versions
Update Qt Framework to a patched release
Avoid importing untrusted 3D scene files until patched
Check whether your applications use Qt Core's CBOR-to-JSON conversion.
Update to the Qt release that includes the fix when it is available.
Monitor Qt security advisories for details.
What the sources say 2
· Mastodon: “An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module.” Source
· Mastodon: “A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module.” Source