Heap Memory Corruption Vulnerability in Qt for MCUs Affecting Qt Quick Ultralite

CVE-2026-94370

What is CVE-2026-94370?

A defect in the core string handling of Qt for MCUs can lead to heap memory corruption. The issue arises when text is passed into the Qt Quick Ultralite framework using the public Qul::String interface type stored in a std::string. In this scenario, the conversion to the internal string type mistakenly copies the pointer without assuming ownership. Consequently, two objects may attempt to release the same memory block, potentially resulting in a double free, invalid free, or use-after-free condition, which can compromise application stability and security.

References