An out-of-bounds read and integer underflow vulnerability in the QNdefNfcTextRecord class of the Qt NFC module (qtconnectivity) has been discovered and has been assigned the CVE id CVE-2026-13326.
Affected versions: from Qt 5.2.0 to Qt 6.8.8, from Qt 6.9.0 to Qt 6.10.3, from Qt 6.11.0 to Qt 6.11.1
Impact: A malicious NFC tag can declare a language code length larger than the payload it actually contains.
When an application reads an NDEF text record, Qt NFC does not bounds-check the declared language code length against the actual size of the payload. The subtraction used to derive the remaining text length underflows, and the resulting oversized length is used to construct the string. The record is therefore read past the end of the payload buffer.
Exploitation requires the attacker's tag to be presented to the device in close proximity, and requires the user to tap the device to the tag. In the worst case the application terminates unexpectedly, resulting in a denial of service. Contents of adjacent memory may also be exposed as part of the returned string, giving a limited loss of confidentiality.
CVSS 4.0 Score: 6.9 / MEDIUM
Vector String: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
Mitigation: Only tap NFC tags from trusted sources. Avoid reading unknown or untrusted NFC tags until the fix below has been applied.
Solution: Apply the following patch, or update to Qt 6.8.9, Qt 6.10.4 or Qt 6.11.2 or later.
