An out-of-bounds read vulnerability in the Qt CoAP message parsing (QCoapInternalReply::createFromFrame()) of the Qt CoAP module has been discovered and has been assigned the CVE id CVE-2026-103653.
Affected versions: from Qt 5.13.0 to Qt 6.8.8, from Qt 6.9.0 to Qt 6.11.2
Impact: Processing a malformed CoAP message can cause an application using Qt CoAP to crash (loss of availability) or to continue operating on incorrect data (potential loss of integrity).
CVSS 4.0 Score: 6.7 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/AU:Y/R:U/RE:L/U:Amber
Mitigation: No workaround is available. Until the update or patches are applied, users can reduce exposure by accepting CoAP traffic only from trusted peers, for example through network filtering.
Solution: Apply the following patches, or update to Qt 6.8.9 LTS, Qt 6.11.3, Qt 6.12.0 or later.
Patches:
dev: https://codereview.qt-project.org/c/qt/qtcoap/+/760652 and https://codereview.qt-project.org/c/qt/qtcoap/+/761120
Qt 6.11: https://codereview.qt-project.org/c/qt/qtcoap/+/764363 and https://codereview.qt-project.org/c/qt/qtcoap/+/764364 or
https://download.qt.io/official_releases/qt/6.11/CVE-2026-103653-qtcoap-6.11-0001.diff and https://download.qt.io/official_releases/qt/6.11/CVE-2026-103653-qtcoap-6.11-0002.diff
Qt 6.8 LTS: https://codereview.qt-project.org/c/qt/tqtc-qtcoap/+/764366 and https://codereview.qt-project.org/c/qt/tqtc-qtcoap/+/764367
or https://download.qt.io/archive/qt/6.8/CVE-2026-103653-qtcoap-6.8-0001.diff and https://download.qt.io/archive/qt/6.8/CVE-2026-103653-qtcoap-6.8-0002.diff
