# Qt.

Every CVE that names Qt among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Integer truncation vulnerability in QTextCodec conversion functions impacts Qt Framework](https://agentprime.io/advisories/CVE-2026-107479.md)
  `CVE-2026-107479` · CVE record: qt Qt · CVSS 1.7 Low · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-197
- [Out-of-bounds read vulnerability in CoAP message parsing impacts Qt CoAP](https://agentprime.io/advisories/CVE-2026-103653.md)
  `CVE-2026-103653` · CVE record: qt Qt · CVSS 6.7 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Memory corruption
- [Integer overflow vulnerability in XML parsing functionality of Qt5Compat impacts Qt](https://agentprime.io/advisories/CVE-2026-100140.md)
  `CVE-2026-100140` · CVE record: qt qt · CVSS 1.9 Low · Not analysed yet · Published 2 Nov 2026 · Tags: Memory corruption
- [Memory corruption vulnerability in QMqttClient impacts Qt MQTT](https://agentprime.io/advisories/CVE-2026-107457.md)
  `CVE-2026-107457` · CVE record: qt Qt · CVSS 2.3 Low · Not analysed yet · Published 2 Nov 2026 · Tags: Memory corruption, CWE-129
- [NULL pointer dereference vulnerability in QCborValue to JSON conversion impacts Qt](https://agentprime.io/advisories/CVE-2026-105924.md)
  `CVE-2026-105924` · CVE record: qt Qt · CVSS 4.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Memory corruption
- [Out-of-bounds write vulnerability in QTextCodec iconv-based encoding impacts Qt](https://agentprime.io/advisories/CVE-2026-107590.md)
  `CVE-2026-107590` · CVE record: qt Qt · CVSS 1.9 Low · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Out-of-bounds read vulnerability in QTextCodec TSCII encoding impacts Qt](https://agentprime.io/advisories/CVE-2026-107472.md)
  `CVE-2026-107472` · CVE record: qt Qt · CVSS 4.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Out-of-bounds read vulnerability in NTLM authentication handling impacts Qt](https://agentprime.io/advisories/CVE-2026-105946.md)
  `CVE-2026-105946` · CVE record: qt qt · CVSS 5.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Out-of-bounds read vulnerability in QCborValue::fromCbor() impacts Qt Framework](https://agentprime.io/advisories/CVE-2026-107157.md)
  `CVE-2026-107157` · CVE record: qt Qt · CVSS 2.0 Low · Not analysed yet · Published 26 Oct 2026 · Tags: Memory corruption
- [Null pointer dereference vulnerability in QNetworkAccessManager impacts Qt](https://agentprime.io/advisories/CVE-2026-96432.md)
  `CVE-2026-96432` · CVE record: qt qt · CVSS 2.1 Low · Not analysed yet · Published 26 Oct 2026 · Tags: Memory corruption
- [Use-after-free vulnerability in QNetworkAccessManager HTTP/2 support impacts Qt](https://agentprime.io/advisories/CVE-2026-95620.md)
  `CVE-2026-95620` · CVE record: qt qt · CVSS 2.1 Low · Not analysed yet · Published 23 Oct 2026 · Tags: Memory corruption
- [Denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts Qt](https://agentprime.io/advisories/CVE-2026-16762.md)
  `CVE-2026-16762` · CVE record: qt qt · CVSS 8.7 High · Not analysed yet · Published 23 Oct 2026 · Tags: Denial of service
- [Null-pointer dereference in QTriangulator reachable through VectorImage](https://agentprime.io/advisories/CVE-2026-105923.md)
  `CVE-2026-105923` · CVE record: qt Qt · CVSS 4.0 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Memory corruption
- [QBinaryJson::fromBinaryData() integer overflow leading to OOB read](https://agentprime.io/advisories/CVE-2026-101201.md)
  `CVE-2026-101201` · CVE record: qt qt · CVSS 4.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Memory corruption
- [Denial-of-service vulnerability in the SVG parser and renderer impacts Qt](https://agentprime.io/advisories/CVE-2026-8168.md)
  `CVE-2026-8168` · CVE record: qt qt · CVSS 7.1 High · Not analysed yet · Published 19 Oct 2026 · Tags: Denial of service
- [Authentication bypass vulnerability in the password authentication mechanism of the Qt VNC Server module](https://agentprime.io/advisories/CVE-2026-79680.md)
  `CVE-2026-79680` · CVE record: qt qt · CVSS 4.5 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Authentication bypass
- [Denial-of-service (stack-exhaustion) vulnerability in QXmlStreamReader::readElementText() impacts Qt](https://agentprime.io/advisories/CVE-2026-78253.md)
  `CVE-2026-78253` · CVE record: qt qt · CVSS 2.3 Low · Not analysed yet · Published 23 Sept 2026 · Tags: Denial of service
- [Out-of-bounds read vulnerability in Context2D.path and PathSvg.path properties impacts Qt Quick](https://agentprime.io/advisories/CVE-2026-79616.md)
  `CVE-2026-79616` · CVE record: qt qt · CVSS 0.6 Low · Not analysed yet · Published 23 Sept 2026 · Tags: Memory corruption
- [Out-of-bounds read (buffer over-read) vulnerability in HTTP Cache-Control response header parsing impacts Qt Framework (QtNetwork module)](https://agentprime.io/advisories/CVE-2026-76151.md)
  `CVE-2026-76151` · CVE record: qt qt · CVSS 4.6 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Memory corruption, CWE-197
- [Unbounded recursion vulnerability in the QDomNode destructor of Qt XML impacts Qt](https://agentprime.io/advisories/CVE-2026-19248.md)
  `CVE-2026-19248` · CVE record: qt qt · CVSS 7.1 High · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service
- [Out-of-bounds read and integer underflow vulnerability in QNdefNfcTextRecord impacts Qt NFC module](https://agentprime.io/advisories/CVE-2026-13326.md)
  `CVE-2026-13326` · CVE record: qt qt · CVSS 6.9 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Memory corruption
- [Uncontrolled recursion in QDomDocument/QDomNode serialization causes stack exhaustion (QtXml)](https://agentprime.io/advisories/CVE-2026-11573.md)
  `CVE-2026-11573` · CVE record: qt qt · CVSS 7.1 High · Not analysed yet · Published 8 Sept 2026 · Tags: Denial of service
- [XML injection vulnerability in QDom comment, CDATA and processing-instruction serialization](https://agentprime.io/advisories/CVE-2026-15037.md)
  `CVE-2026-15037` · CVE record: Qt Qt · CVSS 2.9 Low · Not analysed yet · Published 23 Jul 2026 · Tags: Other injection
- [Out-of-bounds read in QTextCodec::codecForName() in Qt](https://agentprime.io/advisories/CVE-2026-9499.md)
  `CVE-2026-9499` · CVE record: Qt Qt · CVSS 6.3 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Memory corruption
- [Uncontrolled Search Path Element in Qt Network OpenSSL TLS backend allows rogue CA certificate loading](https://agentprime.io/advisories/CVE-2025-14575.md)
  `CVE-2025-14575` · CVE record: Qt Qt · CVSS 1.8 Low · Not analysed yet · Published 19 May 2026 · Tags: CWE-427
- [Type confusion and heap-buffer-overflow in Qt SVG marker handling causing application crash](https://agentprime.io/advisories/CVE-2026-6210.md)
  `CVE-2026-6210` · CVE record: Qt Qt · CVSS 8.7 High · Not analysed yet · Published 6 May 2026 · Tags: Memory corruption
- [Possible QML code injection in VectorImage component](https://agentprime.io/advisories/CVE-2025-14576.md)
  `CVE-2025-14576` · CVE record: Qt Qt · CVSS 7.4 High · Not analysed yet · Published 30 Apr 2026 · Tags: Code injection, CWE-20
- [Improper validation of \<img> tag size in Text component parser](https://agentprime.io/advisories/CVE-2025-12385.md)
  `CVE-2025-12385` · CVE record: Qt Qt · CVSS 8.7 High · Not analysed yet · Published 3 Dec 2025 · Tags: Denial of service, CWE-1284
- [Out-of-bounds read in Qt](https://agentprime.io/advisories/CVE-2025-23050.md)
  `CVE-2025-23050` · CVE record: Qt Qt · CVSS 3.1 Low · Not analysed yet · Published 31 Oct 2025 · Tags: Memory corruption
- [Possible denial of service with multiple incoming connections to a Schannel based server with a TLS backend](https://agentprime.io/advisories/CVE-2025-6338.md)
  `CVE-2025-6338` · CVE record: Qt Qt · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2025 · Tags: CWE-459
- [Use-after-free vulnerability in Qt SVG qsvghandler.cpp allows denial of service via crafted SVG](https://agentprime.io/advisories/CVE-2025-10729.md)
  `CVE-2025-10729` · CVE record: Qt Qt · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Oct 2025 · Tags: Memory corruption
- [Uncontrolled recursion in Qt SVG module](https://agentprime.io/advisories/CVE-2025-10728.md)
  `CVE-2025-10728` · CVE record: Qt Qt · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Oct 2025 · Tags: Denial of service
- [Passing values outside of expected range to QColorTransferGenericFunction can cause a denial of service](https://agentprime.io/advisories/CVE-2025-5992.md)
  `CVE-2025-5992` · CVE record: Qt Qt · CVSS 2.3 Low · Not analysed yet · Published 11 Jul 2025 · Tags: CWE-20
- [Use after free in QHttp2ProtocolHandler](https://agentprime.io/advisories/CVE-2025-5991.md)
  `CVE-2025-5991` · CVE record: Qt Qt · CVSS 2.1 Low · Not analysed yet · Published 11 Jun 2025 · Tags: Memory corruption
- [Resource allocation without limits in Qt](https://agentprime.io/advisories/CVE-2025-5683.md)
  `CVE-2025-5683` · CVE record: Qt Qt · CVSS 5.1 Medium · Not analysed yet · Published 5 Jun 2025 · Tags: Denial of service
- [Possible denial of service when passing malformed data in a URL to qDecodeDataUrl](https://agentprime.io/advisories/CVE-2025-5455.md)
  `CVE-2025-5455` · CVE record: Qt Qt · CVSS 8.4 High · Not analysed yet · Published 2 Jun 2025 · Tags: CWE-20
- [Improper Link Resolution Before File Access in QFileSystemEngine on Windows](https://agentprime.io/advisories/CVE-2025-4211.md)
  `CVE-2025-4211` · CVE record: Qt Qt · CVSS 7.3 High · Not analysed yet · Published 16 May 2025 · Tags: Path traversal
- [Buffer overflow in QTextMarkdownImporter](https://agentprime.io/advisories/CVE-2025-3512.md)
  `CVE-2025-3512` · CVE record: Qt Qt · CVSS 4.8 Medium · Not analysed yet · Published 11 Apr 2025 · Tags: Memory corruption
- [Inefficient algorithmic complexity in Qt](https://agentprime.io/advisories/CVE-2025-30348.md)
  `CVE-2025-30348` · CVE record: Qt Qt · CVSS 5.8 Medium · Not analysed yet · Published 21 Mar 2025 · Tags: Denial of service
- [Integer overflow in Qt](https://agentprime.io/advisories/CVE-2022-40983.md)
  `CVE-2022-40983` · CVE record: Qt Project Qt · CVSS 8.8 High · Not analysed yet · Published 12 Jan 2023 · Tags: Memory corruption
- [Heap-based buffer overflow in Qt](https://agentprime.io/advisories/CVE-2022-43591.md)
  `CVE-2022-43591` · CVE record: Qt Project Qt · CVSS 8.8 High · Not analysed yet · Published 12 Jan 2023 · Tags: Memory corruption
- [Out-of-bounds read in qt](https://agentprime.io/advisories/CVE-2021-3481.md)
  `CVE-2021-3481` · CVE record: qt · No CVSS score · Not analysed yet · Published 22 Aug 2022 · Tags: Memory corruption

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=qt>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/qt/>. Everything for agents: <https://agentprime.io/llms.txt>.