Qt

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Qt product.

RSS Feeds for Qt security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Qt products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Qt Sorted by Most Security Vulnerabilities since 2018

Qt89 vulnerabilities

Qtbase7 vulnerabilities

Qt5compat4 vulnerabilities

Qt For Mcus3 vulnerabilities

Qt Axivion2 vulnerabilities

Qtsvg2 vulnerabilities

Qt Network Authorization1 vulnerability

Qt3d1 vulnerability

Qtcoap1 vulnerability

Qthttpserver1 vulnerability

Qtmqtt1 vulnerability

Qtwebkit1 vulnerability

Qtwebsockets1 vulnerability

By the Year

In 2026 there have been 31 vulnerabilities in Qt with an average score of 4.6 out of ten. Last year, in 2025 Qt had 12 security vulnerabilities published. That is, 19 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.45.

Year	Vulnerabilities	Average Score
2026	31	4.65
2025	12	4.20
2024	5	8.20
2023	13	6.75
2022	3	6.70
2021	2	0.00
2020	6	6.60
2019	2	5.50
2018	6	7.82

It may take a day or so for new Qt vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Qt Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-114366	Nov 06, 2026	Qt QWebSocket Auth Info Disclosure (CVE-2026-114366) An information disclosure vulnerability in the Qt Framework QWebSocket authentication handling of the Qt WebSockets module.	Qt Qtwebsockets
CVE-2026-107479	Nov 04, 2026	Qt QTextCodec Integer Truncation Crash in Qt 5 Core Compatibility APIs An integer truncation vulnerability in the QTextCodec conversion functions of the Qt 5 Core Compatibility APIs module impacts the Qt Framework. An application using the affected functionality could crash.	Qt Qt5compat Qtbase And others...
CVE-2026-110944	Nov 04, 2026	Qt HTTP Server QHttpServer Resource Exhaustion Resource exhaustion vulnerability in the HTTP request handling of the QHttpServer component of Qt HTTP Server.	Qt Qthttpserver
CVE-2026-103653	Nov 03, 2026	Qt CoAP Out-of-Bounds Read in QCoapInternalReply An out-of-bounds read vulnerability in the Qt CoAP message parsing (QCoapInternalReply::createFromFrame()) of the Qt CoAP module. Processing a malformed CoAP message can cause an application using Qt CoAP to crash (loss of availability) or to continue operating on incorrect data (potential loss of integrity).	Qt Qtcoap
CVE-2026-100140	Nov 02, 2026	Qt XML Parser Integer Overflow (Qt5Compat/QXmlSimpleReader) An integer overflow vulnerability in the Qt XML parsing (Qt5Compat / QXmlSimpleReader) functionality of Qt.	Qt Qt5compat
CVE-2026-107457	Nov 02, 2026	Memory corruption in QMqttClient (Qt MQTT) can cause crashes A memory corruption vulnerability in the QMqttClient class of the Qt MQTT module. Under certain MQTT 5 connection settings between client and server, QMqttClient may corrupt memory, which can cause the application to crash.	Qt Qtmqtt
CVE-2026-111487	Oct 30, 2026	Qt3D assimp plugin OOB write (CVE-2026-111487) An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module.	Qt Qt3d
CVE-2026-107590	Oct 27, 2026	Qt Core QTextCodec Out-of-Bounds Write (CVE-2026-107590) An out-of-bounds write vulnerability in the Qt QTextCodec iconv-based encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt. Under certain conditions, encoding text with QTextCodec may write outside an internal buffer. This can cause the application to crash and may affect data integrity.	Qt Qt5compat Qtbase And others...
CVE-2026-107472	Oct 27, 2026	Qt QTextCodec TSCII OOB Read (CVE-2026-107472) An out-of-bounds read vulnerability in the QTextCodec TSCII encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt. Applications that convert text to the TSCII encoding through QTextCodec may read memory outside the input buffer, which can cause the application to crash or misinterpret the data.	Qt Qt5compat Qtbase And others...
CVE-2026-105946	Oct 27, 2026	Qt QAuthenticator NTLM OOB Read in QNetworkAccessManager Out-of-bounds read in the QAuthenticator NTLM authentication handling in the Qt Network module in Qt Group Qt allows remote attackers to obtain sensitive information (heap memory contents) or cause a denial of service (application crash) via a crafted NTLM challenge sent by a malicious server or proxy, when an application using QNetworkAccessManager or QTcpSocket authenticates with NTLM.	Qt Qtbase
CVE-2026-96432	Oct 26, 2026	Qt QNetworkAccessManager Null Ptr via HTTP/2 RST_STREAM + PUSH_PROMISE A malicious or compromised HTTP/2 server withholding SETTINGS ACK can send RST_STREAM on a completed stream, planting a null pointer, and then send a PUSH_PROMISE for that stream, causing a null pointer dereference in the QNetworkAccessManager class of the Qt Network module that crashes the application.	Qt Qtbase
CVE-2026-95620	Oct 23, 2026	Qt QNetworkAccessManager HTTP/2 Use-After-Free Crash Vulnerability A use-after-free vulnerability in the Qt QNetworkAccessManager HTTP/2 client support of the Qt Network module allows a malicious or compromised HTTP/2 server to cause the client application to crash, affecting availability.	Qt
CVE-2026-16762	Oct 23, 2026	Qt QXmlStreamReader XML DoS via CPU Exhaustion An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity no data disclosure, data modification, or code execution and the impact is contained to the affected process.	Qt Qtbase
CVE-2026-8168	Oct 19, 2026	QtSvg Uncontrolled Recursion in SVG Parser Causing DoS Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.	Qt Qtsvg
CVE-2026-94370	Oct 14, 2026	Qt for MCUs String Handling Heap Corruption via Double Free A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion to the internal string type copies the pointer without taking ownership of it. Two objects then release the same memory, producing a double free, an invalid free, or a use-after-free.	Qt For Mcus
CVE-2026-19395	Oct 05, 2026	Qt for MCUs Text Element Empty <img> Attribute Causes HALT In Qt for MCUs, a Text element that displays styled text halts the device if an <img> tag in the text contains an attribute with an empty value. The text parser passes the empty value to an internal check that only accepts non-empty values. The check fails and reports an error, and the default error handler halts the device.	Qt For Mcus
CVE-2026-95509	Sep 29, 2026	Qt OOB Read via String.arg() Buffer Size Error in Latin-1 Strings Strings optimized for Latin-1 displaying Latin-1 characters cause incorrect String.arg() formatting by an incorrect buffer size calculation, causing out-of-bounds reading.	Qt For Mcus
CVE-2026-79680	Sep 24, 2026	Qt VNC Server Password Auth Bypass via Malformed RFB Client Authentication bypass vulnerability in the password authentication mechanism of the Qt VNC Server module. An attacker using a specially modified VNC client that violates the RFB protocol can bypass Qt VNC Server's password authentication and gain unauthorized remote access to the shared application, compromising the confidentiality and integrity of the session.	Qt
CVE-2026-78253	Sep 23, 2026	Qt QXmlStreamReader::readElementText Stack Exhaustion DoS Uncontrolled recursion in QXmlStreamReader::readElementText() in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted XML document.	Qt
CVE-2026-79616	Sep 23, 2026	Qt Quick OOB Read via Malicious SVG Path in Context2D.path Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path.	Qt
CVE-2026-76151	Sep 16, 2026	QtNetwork OOB Read in Qt 6.06.11.1 CVE202676151 Out-of-bounds read (buffer over-read) in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Group Qt 6.0.0 through 6.8.8, and 6.9.0 through 6.11.1, allows remote attackers to cause a denial of service (application crash) via an excessively large Cache-Control header value returned by an untrusted or compromised HTTP server to an application using QNetworkAccessManager. Only the client side of the connection is affected and 32-bit builds are not affected; the out-of-bounds access is read-only, with no information disclosure and no code execution.	Qt
CVE-2026-19248	Sep 16, 2026	Qt QDomDocument XML DoS via Untrusted Input QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.	Qt
CVE-2026-13326	Sep 11, 2026	Qt NFC OOB Read via NFC Tag Causing DoS/Memory Disclosure An out-of-bounds read in Qt NFC's language code length parsing allows a physically proximate attacker to cause a denial of service or limited memory disclosure via a crafted NFC tag.	Qt
CVE-2026-11573	Sep 08, 2026	QtXml QDomNode recursion before Qt 5.15 - DoS Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). QDomElementPrivate::save() and QDomNodePrivate::save() recurse mutually, consuming one stack frame per level of element nesting with no depth limit, no configurable bound and no error return. A document with deeply nested elements parses successfully but exhausts the call stack and terminates the process when serialized. Reachable via QDomDocument::toByteArray() (Qt 4.0 and later), QDomDocument::toString(), QDomDocument::toCString(), QDomNode::save(), and operator<<(QTextStream&, const QDomNode&). Denial of service only no code execution and no memory disclosure.	Qt
CVE-2026-15037	Jul 23, 2026	Qt XML 4.0-6.11 XML Injection via QDom Nodes (Fixed in 6.12) Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12.	Qt
CVE-2026-9499	Jul 21, 2026	Qt 6.0+ QTextCodec::codecForName OOB read (CVE-2026-9499) An out-of-bounds read (buffer over-read) vulnerability exists in QTextCodec::codecForName() in Qt. When the function is called with a QByteArray that is not NUL-terminated (for example, one created with QByteArray::fromRawData()), the codec-name matching routine reads past the end of the supplied buffer. In most cases this results in an incorrect text codec being selected; in the worst case, if the over-read reaches unmapped memory, the process crashes (denial of service). The over-read is bounded by the length of the longest codec-name candidate, and the out-of-bounds bytes are only compared internally against Qt's fixed list of codec names, so no data is disclosed to an attacker. Applications that do not pass non-NUL-terminated QByteArrays to QTextCodec::codecForName() are not exposed. The affected code resides in the Qt5Compat module from Qt 6.0.0 onward, and in Qt Core (qtbase) in Qt 4.x and Qt 5.x.	Qt
CVE-2026-12379	Jul 16, 2026	Axivion Dashboard OAuth/OpenID Connect Redirect CVE-2026-12379 An Open Redirect vulnerability (CWE-601) exists in the OAuth/OIDC authentication implementation of the Axivion Dashboard. The login flow did not properly restrict the post-authentication redirect to the application's own origin, so a user who follows a crafted login link can be sent to an untrusted external site after authenticating against the genuine Dashboard. Because the link points at the legitimate Dashboard, this can be abused for phishing, for example credential or second-factor theft via a convincing look-alike page. Exploitation requires the victim to follow the attacker-supplied link and complete the authentication flow.	Axivion
CVE-2026-12593	Jul 09, 2026	Privilege Escalation via Unchecked Owner on Dashboard Token API The implementation of an internal and undocumented Dashboard API endpoint (POST /api/users/~/{user}/tokens) forgot to ensure an HTTP request for creating an API Token for another user had sufficient permission to do so. Precondition for successful exploitation was a preexisting internal user (with more privileges than the attacker), the attacker knowing its login name and the attacker being able to authenticate to the Dashboard via OAuth/OIDC. The attacker would then have had to forge a token creation API request on behalf of the other user and could have authenticated and finalized the token creation with their own OAuth/OIDC credentials. In the worst case, this would mean an attacker could have become Dashboard Administrator and been able to perform all administrative actions if the preexisting internal user had administrative privileges. In combination with a separate weakness, this could have further led to code execution on the host system running the Dashboard with the privileges of the OS-User running the Dashboard server.	Axivion
CVE-2025-14575	May 19, 2026	Qt OpenSSL TLS Backend Uncontrolled Search Path CVE-2025-14575 An Uncontrolled Search Path Element vulnerability in the OpenSSL TLS backend of Qt Network (qtbase) in Qt Qt Framework (Unix) allows a local attacker to load a rogue CA certificate as a trusted system authority via a crafted certificate file placed in the application's working directory.	Qt
CVE-2026-6210	May 06, 2026	Type Confusion in Qt SVG 6.7.x-6.8.7 & 6.9.x-6.11.0 Crashes A type confusion vulnerability in Qt SVG allows an attacker to cause an application crash via a crafted SVG image. When processing SVG marker references, the renderer retrieves a node by its id attribute and casts it to QSvgMarker* without verifying the node type. A non-marker element (such as a <line> element) that references itself as a marker triggers an out-of-bounds heap read due to the object size difference between QSvgLine and QSvgMarker, followed by an endless recursion that bypasses the marker recursion guard through incorrect virtual dispatch. The result is an application crash (denial of service). This issue affects Qt SVG: from 6.7.0 before 6.8.8, from 6.9.0 before 6.11.1.	Qt
CVE-2025-14576	Apr 30, 2026	Qt Quick SVG: Node ID flaw enables QML/JS injection via VectorImage Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick. While QML execution is typically more restricted than native code execution, this could still lead to denial of service, information disclosure, or other impacts depending on the application's privilege level and data access.	Qt
CVE-2025-12385	Dec 03, 2025	Qt Quick Text 5.0-6.10: unchecked <img> w/h causes DoS Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability in The Qt Company Qt on Windows, MacOS, Linux, iOS, Android, x86, ARM, 64 bit, 32 bit allows Excessive Allocation. This issue affects users of the Text component in Qt Quick. Missing validation of the width and height in the <img> tag could cause an application to become unresponsive. This issue affects Qt: from 5.0.0 through 6.5.10, from 6.6.0 through 6.8.5, from 6.9.0 through 6.10.0.	Qt
CVE-2025-23050	Oct 31, 2025	Out-of-bounds read in QLowEnergyController (Qt <6.8.2) QLowEnergyController in Qt before 6.8.2 mishandles malformed Bluetooth ATT commands, leading to an out-of-bounds read (or division by zero). This is fixed in 5.15.19, 6.5.9, and 6.8.2.	Qt
CVE-2025-6338	Oct 16, 2025	Qt Network Schannel Incomplete Cleanup DoS (5.15.06.8.3, 6.9.06.9.1) There is an incomplete cleanup vulnerability in Qt Network's Schannel support on Windows which can lead to a Denial of Service over a long period. This issue affects Qt from 5.15.0 through 6.8.3, from 6.9.0 before 6.9.2.	Qt
CVE-2025-10729	Oct 03, 2025	UAF in XML Parser: <pattern> Node Not Child of Structural Node The module will parse a <pattern> node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading to a use after free.	Qt
CVE-2025-10728	Oct 03, 2025	SVG <pattern> Recursion Causing Stack Overflow DoS When the module renders a Svg file that contains a <pattern> element, it might end up rendering it recursively leading to stack overflow DoS	Qt
CVE-2025-5992	Jul 11, 2025	Qt 6.6-6.9 DoS via QColorTransferGenericFunction When passing values outside of the expected range to QColorTransferGenericFunction it can cause a denial of service, for example, this can happen when passing a specifically crafted ICC profile to QColorSpace::fromICCProfile. This issue affects Qt from 6.6.0 through 6.8.3, from 6.9.0 through 6.9.1. This is fixed in 6.8.4 and 6.9.2.	Qt
CVE-2025-5991	Jun 11, 2025	Qt QHttp2ProtocolHandler Use-After-Free in Qt 6.9.0 (fixed in 6.9.1) There is a "Use After Free" vulnerability in Qt's QHttp2ProtocolHandler in the QtNetwork module. This only affects HTTP/2 handling, HTTP handling is not affected by this at all. This happens due to a race condition between how QHttp2Stream uploads the body of a POST request and the simultaneous handling of HTTP error responses. This issue only affects Qt 6.9.0 and has been fixed for Qt 6.9.1.	Qt
CVE-2025-5683	Jun 05, 2025	Qt QImage ICNS Crash (6.3.0-6.9.0, fixed 6.5.10/6.8.5/6.9.1) When loading a specifically crafted ICNS format image file in QImage then it will trigger a crash. This issue affects Qt from versions 6.3.0 through 6.5.9, from 6.6.0 through 6.8.4, 6.9.0. This is fixed in 6.5.10, 6.8.5 and 6.9.1.	Qt
CVE-2025-5455	Jun 02, 2025	QtCore qDecodeDataUrl assertion DoS before 6.5.9 An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code. If the function was called with malformed data, for example, an URL that contained a "charset" parameter that lacked a value (such as "data:charset,"), and Qt was built with assertions enabled, then it would hit an assertion, resulting in a denial of service (abort). This impacts Qt up to 5.15.18, 6.0.0->6.5.8, 6.6.0->6.8.3 and 6.9.0. This has been fixed in 5.15.19, 6.5.9, 6.8.4 and 6.9.1.	Qt
CVE-2025-4211	May 16, 2025	Qt corelib Link Resolution flaw in QFileSystemEngine pre-5.15.19, 6.5.9 Improper Link Resolution Before File Access ('Link Following') vulnerability in QFileSystemEngine in the Qt corelib module on Windows which potentially allows Symlink Attacks and the use of Malicious Files. Issue originates from CVE-2024-38081. The vulnerability arises from the use of the GetTempPath API, which can be exploited by attackers to manipulate temporary file paths, potentially leading to unauthorized access and privilege escalation. The affected public API in the Qt Framework is QDir::tempPath() and anything that uses it, such as QStandardPaths with TempLocation, QTemporaryDir, and QTemporaryFile. This issue affects all version of Qt up to and including 5.15.18, from 6.0.0 through 6.5.8, from 6.6.0 through 6.8.1. It is fixed in Qt 5.15.19, Qt 6.5.9, Qt 6.8.2, 6.9.0	Qt
CVE-2025-3512	Apr 11, 2025	Qt 6.8.0-6.8.4 Heap-based Buffer Overflow in QTextMarkdownImporter There is a Heap-based Buffer Overflow vulnerability in QTextMarkdownImporter. This requires an incorrectly formatted markdown file to be passed to QTextMarkdownImporter to trigger the overflow. This issue affects Qt from 6.8.0 to 6.8.4. Versions up to 6.6.0 are known to be unaffected, and the fix is in 6.8.4 and later.	Qt
CVE-2025-30348	Mar 21, 2025	Qt QDom encodeText complex algorithm flaw before 6.8.0 encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).	Qt
CVE-2023-45872	Oct 09, 2024	Qt 6.6.x/6.3.x DoS via QML Image Assuming SVG An issue was discovered in Qt before 6.2.11 and 6.3.x through 6.6.x before 6.6.1. When a QML image refers to an image whose content is not known yet, there is an assumption that it is an SVG document, leading to a denial of service (application crash) if it is not actually an SVG document.	Qt
CVE-2024-39936	Jul 04, 2024	Qt HTTP2 Early Decision Before Encrypted() (CVE-2024-39936) An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6.7.3. Code to make security-relevant decisions about an established connection may execute too early, because the encrypted() signal has not yet been emitted and processed..	Qt
CVE-2024-36048	May 18, 2024	Predictable PRNG Seeding in Qt QAbstractOAuth (pre-5.15.17/6.2.13) QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.x before 6.7.1 uses only the time to seed the PRNG, which may result in guessable values.	Qt Qt Network Authorization
CVE-2024-25580	Mar 27, 2024	Qt KTX Buffer Overflow (pre-5.15.17/6.2.12/6.5.5/6.6.2) An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file.	Qt
CVE-2024-30161	Mar 24, 2024	Qt 6.5.x/6.6.2 QNetworkReply DP Leak in WebAssembly In Qt 6.5.4, 6.5.5, and 6.6.2, QNetworkReply header data might be accessed via a dangling pointer in Qt for WebAssembly (wasm). (Earlier and later versions are unaffected.)	Qt
CVE-2023-51714	Dec 24, 2023	Qt HPACK Integer Overflow HTTP/2 (<5.15.17, <6.2.11, <6.5.4, <6.6.2) An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check.	Qt
CVE-2023-43114	Sep 18, 2023	Qt 5.15.x/6.x GDI Crash via QFontDatabase::addApplicationFont[FromData] An issue was discovered in Qt before 5.15.16, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3 on Windows. When using the GDI font engine, if a corrupted font is loaded via QFontDatabase::addApplicationFont{FromData], then it can cause the application to crash because of missing length checks.	Qt