CVE-2026-96432

Null pointer dereference vulnerability in QNetworkAccessManager impacts Qt

A malicious or compromised HTTP/2 server withholding SETTINGS ACK can send RST_STREAM on a completed stream, planting a null pointer, and then send a PUSH_PROMISE for that stream, causing a null pointer dereference in the QNetworkAccessManager class of the Qt Network module that crashes the application.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Qt

Products

Qt Qtbase

CVE-2026-16762

Denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts Qt

An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity — no data disclosure, data modification, or code execution — and the impact is contained to the affected process.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Qt

Products

Qt Qtbase

CVE-2026-101201

QBinaryJson::fromBinaryData() integer overflow leading to OOB read

A malformed header in the binary file fed to QBinaryJson::fromBinaryData() can cause undefined behaviour because of out-of-bounds read.

CVSS 4.0 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Qt

Products

Qt Qt5compat Qtbase

CVE-2026-8168

Denial-of-service vulnerability in the SVG parser and renderer impacts Qt

Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Qt

Products

Qt Qtsvg

CVE-2026-94370

Memory corruption (double free / use-after-free) vulnerability in core string handling impacts Qt for MCUs

A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion to the internal string type copies the pointer without taking ownership of it. Two objects then release the same memory, producing a double free, an invalid free, or a use-after-free.

CVSS 4.0 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qt

Products

Qt For Mcus

CVE-2023-51714

qt: incorrect integer overflow check

An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Debian Qt Redhat

Products

Debian Linux Qt Enterprise Linux

CVE-2020-24742

qt: QPluginLoader loads plugins relative to CWD which could result in arbitrary code execution

An issue has been fixed in Qt versions 5.14.0 where QPluginLoader attempts to load plugins relative to the working directory, allowing attackers to execute arbitrary code via crafted files.

CVSS 3.1 · 7.8 High EPSS 1.2% KEV · Not listed

Vendors

Qt

Products

Qt

CVE-2020-0570

qt: files placed by attacker can influence the working directory and lead to malicious code execution

Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated user to potentially enable elevation of privilege via local access.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Qt Redhat

Products

Qt Enterprise Linux

CVE-2026-19395

An empty <img> attribute value in styled text triggers a parser error that halts the device.

In Qt for MCUs, a Text element that displays styled text halts the device if an <img> tag in the text contains an attribute with an empty value. The text parser passes the empty value to an internal check that only accepts non-empty values. The check fails and reports an error, and the default error handler halts the device.

CVSS 4.0 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Qt Redhat

Products

Qt For Mcus Hummingbird

CVE-2026-95509

Out-of-bounds read vulnerability in string formatting impacts Qt for MCUs

Strings optimized for Latin-1 displaying Latin-1 characters cause incorrect String.arg() formatting by an incorrect buffer size calculation, causing out-of-bounds reading.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Qt

Products

Qt For Mcus

CVE-2026-79680

Authentication bypass vulnerability in the password authentication mechanism of the Qt VNC Server module

Authentication bypass vulnerability in the password authentication mechanism of the Qt VNC Server module. An attacker using a specially modified VNC client that violates the RFB protocol can bypass Qt VNC Server's password authentication and gain unauthorized remote access to the shared application, compromising the confidentiality and integrity of the session.

CVSS 4.0 · 4.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qt

Products

Qt

CVE-2026-79616

Out-of-bounds read vulnerability in Context2D.path and PathSvg.path properties impacts Qt Quick

Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path.

CVSS 4.0 · 0.6 Low EPSS < 1% KEV · Not listed

Vendors

Qt

Products

Qt

CVE-2026-78253

Denial-of-service (stack-exhaustion) vulnerability in QXmlStreamReader::readElementText() impacts Qt

Uncontrolled recursion in QXmlStreamReader::readElementText() in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted XML document.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Qt

Products

Qt

CVE-2026-19248

Unbounded recursion vulnerability in the QDomNode destructor of Qt XML impacts Qt

QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Qt

Products

Qt

CVE-2026-76151

Out-of-bounds read (buffer over-read) vulnerability in HTTP Cache-Control response header parsing impacts Qt Framework (QtNetwork module)

Out-of-bounds read (buffer over-read) in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Group Qt 6.0.0 through 6.8.8, and 6.9.0 through 6.11.1, allows remote attackers to cause a denial of service (application crash) via an excessively large Cache-Control header value returned by an untrusted or compromised HTTP server to an application using QNetworkAccessManager. Only the client side of the connection is affected and 32-bit builds are not affected; the out-of-bounds access is read-only, with no information disclosure and no code execution.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Qt

Products

Qt

CVE-2026-13326

Out-of-bounds read and integer underflow vulnerability in QNdefNfcTextRecord impacts Qt NFC module

An out-of-bounds read in Qt NFC's language code length parsing allows a physically proximate attacker to cause a denial of service or limited memory disclosure via a crafted NFC tag.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Qt

Products

Qt

CVE-2026-11573

Uncontrolled recursion in QDomDocument/QDomNode serialization causes stack exhaustion (QtXml)

Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). QDomElementPrivate::save() and QDomNodePrivate::save() recurse mutually, consuming one stack frame per level of element nesting with no depth limit, no configurable bound and no error return. A document with deeply nested elements parses successfully but exhausts the call stack and terminates the process when serialized. Reachable via QDomDocument::toByteArray() (Qt 4.0 and later), QDomDocument::toString(), QDomDocument::toCString(), QDomNode::save(), and operator<<(QTextStream&, const QDomNode&). Denial of service only — no code execution and no memory disclosure.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Qt

Products

Qt

CVE-2026-15037

XML injection vulnerability in QDom comment, CDATA and processing-instruction serialization

Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12.

CVSS 4.0 · 2.9 Low EPSS < 1% KEV · Not listed

Vendors

Qt

Products

Qt

CVE-2026-6210

Type confusion and heap-buffer-overflow in Qt SVG marker handling causing application crash

A type confusion vulnerability in Qt SVG allows an attacker to cause an application crash via a crafted SVG image. When processing SVG marker references, the renderer retrieves a node by its id attribute and casts it to QSvgMarker* without verifying the node type. A non-marker element (such as a <line> element) that references itself as a marker triggers an out-of-bounds heap read due to the object size difference between QSvgLine and QSvgMarker, followed by an endless recursion that bypasses the marker recursion guard through incorrect virtual dispatch. The result is an application crash (denial of service). This issue affects Qt SVG:  from 6.7.0 before 6.8.8, from 6.9.0 before 6.11.1.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Qt The Qt Company

Products

Qt Qt

CVE-2025-14576

Possible QML code injection in VectorImage component

Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick. While QML execution is typically more restricted than native code execution, this could still lead to denial of service, information disclosure, or other impacts depending on the application's privilege level and data access.

CVSS 4.0 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Qt The Qt Company

Products

Qt Qtdeclarative Qt