Integer Overflow and Null-Pointer Dereference in Qt VectorImage QML Type
CVE-2026-105923

4MEDIUM

Key Information:

Vendor

Qt

Status
Qt
Vendor
CVE Published:
21 October 2026

What is CVE-2026-105923?

A vulnerability in Qt's VectorImage QML Type allows a crafted SVG file to exploit an integer overflow. This overflow can lead to a null-pointer dereference, which may cause application crashes or lead to additional security risks. Developers should review their implementations to mitigate potential exploitation of this flaw.

Affected Version(s)

Qt 6.8.0 < 6.8.9

Qt 6.9.0 < 6.11.3

References

https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_pr...
vendor-advisory
https://codereview.qt-project.org/c/qt%2Fqtbase/+/762279
patch

CVSS V4

Score:
4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.