Out-of-Bounds Read Vulnerability in Qt Framework by The Qt Company
CVE-2026-107157

2LOW

Key Information:

Vendor

Qt

Status
Qt
Vendor
CVE Published:
26 October 2026

What is CVE-2026-107157?

An out-of-bounds read vulnerability has been identified in the QCborValue::fromCbor() function within the Qt Framework. This flaw enables attackers to potentially access unauthorized memory locations, leading to information disclosure and compromising the integrity of applications using this framework. Developers utilizing affected versions should apply the latest patches to mitigate the risks associated with this vulnerability.

Affected Version(s)

Qt 64 bit 5.12.0 <= 6.8.8

Qt 64 bit 6.9.0 <= 6.11.1

Qt 64 bit 0 < 5.12.0

References

https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_pr...
vendor-advisory
https://codereview.qt-project.org/c/qt/qtbase/+/745719
patch

CVSS V4

Score:
2
Severity:
LOW
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.