Skip to main content

Security advisory: CVE-2026-100140: Integer overflow vulnerability in XML parsing functionality of Qt5Compat impacts Qt

by Mehdi Belila
Comments

 An integer overflow vulnerability in the Qt XML parsing (Qt5Compat / QXmlSimpleReader) functionality of Qt has been discovered and has been assigned the CVE id CVE-2026-100140. 

Affected versions: from Qt 6.0 to Qt 6.8.9, from Qt 6.9.0 to Qt 6.11.2, Qt 6.12.0
 
Impact: Processing a specially crafted XML document may trigger an integer overflow in the XML parser. This may lead to incorrect internal memory handling. In the worst case this can result in an application crash (denial of service) or data corruption.
 
CVSS 4.0 Score: 1.9 (Low)
 
Vector String: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/R:U
 
Mitigation: Validate or reject unreasonably large XML input before parsing.
 
Solution: Apply the following patches or update to Qt 6.8.10, Qt 6.11.3, Qt 6.12.1 or later.
 

 

Blog Topics

Comments

Comments are disabled for this post.

Subscribe to our blog

Try Qt 6.12 Now!

Download the latest release here: www.qt.io/download

Qt 6.12 LTS is now available, with new features and improvements for application developers and device creators.

We're Hiring

Check out all our open positions here and follow us on Instagram to see what it's like to be #QtPeople.

Related Articles

Security advisory: CVE-2026-111487: Out-of-bounds write vulnerability in the assimp scene import plugin of Qt3D impacts Qt Framework

Security advisory: CVE-2026-111487: Out-of-bounds write vulnerability in the assimp scene import plugin of Qt3D impacts Qt Framework

An out-of-bounds write vulnerability in the Qt Framework assimp scene..

Read Article
Security advisory: CVE-2026-107457 Memory corruption vulnerability in QMqttClient impacts Qt MQTT

Security advisory: CVE-2026-107457 Memory corruption vulnerability in QMqttClient impacts Qt MQTT

A memory corruption vulnerability in the QMqttClient class of the Qt MQTT..

Read Article