Integer Overflow Vulnerability in Qt XML Parsing Functionality by The Qt Company
CVE-2026-100140

1.9LOW

Key Information:

Vendor

Qt

Status
Qt
Vendor
CVE Published:
2 November 2026

What is CVE-2026-100140?

An integer overflow vulnerability has been identified in the Qt XML parsing functionality, specifically within the Qt5Compat module and QXmlSimpleReader component. This flaw may potentially allow attackers to exploit malformed XML inputs, leading to unforeseen behaviors or application crashes, which could compromise the security of the application. It is crucial for users and developers relying on affected versions to be aware of this issue and apply the necessary patches to mitigate potential risks.

Affected Version(s)

qt 6.0.0 <= 6.8.9

qt 6.9.0 <= 6.11.2

qt 6.12.0

References

https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_pr...
vendor-advisory
https://codereview.qt-project.org/c/qt/qt5compat/+/768900
patch
https://codereview.qt-project.org/c/qt/qt5compat/+/764751
patch

CVSS V4

Score:
1.9
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.