Hi,

The following vulnerability was published for qt6-3d.

CVE-2026-111487[0]:
| An out-of-bounds write vulnerability in the Qt Framework assimp
| scene import plugin of the Qt3D module.

https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-111487:
Fixed by: https://github.com/qt/qt3d/commit/35822a8d599af285fb23e52168bcb380b0aa31ee (v6.11.3)


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-111487
https://www.cve.org/CVERecord?id=CVE-2026-111487

Please adjust the affected versions in the BTS as needed.

We believe that the bug you reported is fixed in the latest version of
qt6-3d, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1153616@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Patrick Franz <deltaone@debian.org> (supplier of updated qt6-3d package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 10 Nov 2026 18:39:44 +0100
Source: qt6-3d
Architecture: source
Version: 6.11.2+dfsg-3
Distribution: unstable
Urgency: medium
Maintainer: Debian Qt/KDE Maintainers <debian-qt-kde@lists.debian.org>
Changed-By: Patrick Franz <deltaone@debian.org>
Closes: 1153616
Changes:
 qt6-3d (6.11.2+dfsg-3) unstable; urgency=medium
 .
   [ Patrick Franz ]
   * Backport patch to fix CVE-2026-111487 (Closes: #1153616).
Checksums-Sha1:
 fee594b58ae36d0ff3767204dcdd5c4d7712043e 4490 qt6-3d_6.11.2+dfsg-3.dsc
 fc7da7fc80b8643c1902727574287d3d46b2f657 64672 qt6-3d_6.11.2+dfsg-3.debian.tar.xz
 8af9addaae726b5518b45d0b7f020d6ef4657e8e 12150 qt6-3d_6.11.2+dfsg-3_source.buildinfo
Checksums-Sha256:
 061ce2c8fbcf0e6800b52d7b483fb34b4d8621bbe919962a4b43fff6c7698ad4 4490 qt6-3d_6.11.2+dfsg-3.dsc
 a833ddb0be6f842dd3cf0449af8ef8c891a8e1d09c8428579f29385169cc870f 64672 qt6-3d_6.11.2+dfsg-3.debian.tar.xz
 f2d09726905a9d307189d6b2366f4fa2543bdc13c9914e9e39fa18ecdca24769 12150 qt6-3d_6.11.2+dfsg-3_source.buildinfo
Files:
 0f6a3be24a89102339918c9e93d9a66f 4490 libs optional qt6-3d_6.11.2+dfsg-3.dsc
 79ee1da5db0184381dca919c8e614e65 64672 libs optional qt6-3d_6.11.2+dfsg-3.debian.tar.xz
 4d6c5662f3d9507a348da8b8db496361 12150 libs optional qt6-3d_6.11.2+dfsg-3_source.buildinfo
-----BEGIN PGP SIGNATURE-----

wsG7BAEBCgBvBYJq81i5CRCen3pgMHf+VkcUAAAAAAAeACBzYWx0QG5vdGF0aW9u
cy5zZXF1b2lhLXBncC5vcmfqpR9iXdrv16sD8/yLZAR8Pa19ZhGoO+SZFX+QFwH0
PhYhBGKHQVw0evHMWR7typ6femAwd/5WAABYzRAAsq0G7SHiYSBG1p5BI/B/1IZ9
TwXGkUBxqogJLOHFGbYfIGHbWrgUfkUQcmYlQRMjTvR/VKKzM/7ulz98OiAGTC5b
1flavkLG7V1z9iU1yQKBBGR3Zt9W+yB8G7kN8g2mMCkqCJeYZ8R7VXhvx6JxgNS0
B6eh6e4PQiyr3u///YH8TanmUfPSPjFLBtdjvXslZWBMq9fbbuOZ9VUFEsLXWsP0
UYSMsIalX5GIh9fNhjdMFu99GweXe6rYyn4sjbUgoOxpK0nLKcCp+/WWcj+y4MRb
WKaI7bW1zOwMvSDe0IPVZGDzWmO7unoYkCU8e3y2BRftOVWYsJCUE0tdusi0UGvJ
e7HNRIEtwvphjZBoCYaQL8/87v+wdm3kSgGgJU1C1cdslndoNQyiCI4t0WZlAtvQ
e+MxGugg/bucDukk9R4HvmvVK1M1gTbl+tQP33KunaPrOc+b56jVBadK9ibwu01r
wxGshFmMumHxJKxrtq4t6rBPsyyriBV1lDPQ/+++b6KIuMbPHrCZGOC5GHvzGk/g
J5HKj2DRXgAqtJnyG3AfTc6xSXWuR1Wd9LubCtNIKHdFUof+gORDVJnMwh2eQVpf
olF/xNKBnwq+Fgj3FEcZZlZjowOZ8q207i1KFRZTPo1VsHRkrYvQqQjAUyBF2ACQ
8zEnAujihGDZdzaWHZs=
=+XiL
-----END PGP SIGNATURE-----