Qtbase
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Qtbase.
By the Year
In 2026 there have been 8 vulnerabilities in Qtbase with an average score of 3.3 out of ten. Qtbase did not have any published security vulnerabilities last year. That is, 8 more vulnerabilities have already been reported in 2026 as compared to last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 8 | 3.33 |
| 2025 | 0 | 0.00 |
| 2024 | 0 | 0.00 |
| 2023 | 0 | 0.00 |
| 2022 | 0 | 0.00 |
| 2021 | 0 | 0.00 |
| 2020 | 0 | 0.00 |
| 2019 | 1 | 0.00 |
It may take a day or so for new Qtbase vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Qtbase Security Vulnerabilities
Qt Network HTTP Response DoS via Uncontrolled Resource Consumption
CVE-2026-116337
0.6 - Low
- November 09, 2026
Uncontrolled resource consumption vulnerability in the Qt Framework HTTP response handling functionality of the Qt Network module.
Allocation of Resources Without Limits or Throttling
Qt QTextCodec Integer Truncation Crash in Qt 5 Core Compatibility APIs
CVE-2026-107479
1.7 - Low
- November 04, 2026
An integer truncation vulnerability in the QTextCodec conversion functions of the Qt 5 Core Compatibility APIs module impacts the Qt Framework. An application using the affected functionality could crash.
Numeric Truncation Error
Qt Core QTextCodec Out-of-Bounds Write (CVE-2026-107590)
CVE-2026-107590
1.9 - Low
- October 27, 2026
An out-of-bounds write vulnerability in the Qt QTextCodec iconv-based encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt. Under certain conditions, encoding text with QTextCodec may write outside an internal buffer. This can cause the application to crash and may affect data integrity.
Memory Corruption
Qt QTextCodec TSCII OOB Read (CVE-2026-107472)
CVE-2026-107472
4.3 - Medium
- October 27, 2026
An out-of-bounds read vulnerability in the QTextCodec TSCII encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt. Applications that convert text to the TSCII encoding through QTextCodec may read memory outside the input buffer, which can cause the application to crash or misinterpret the data.
Out-of-bounds Read
Qt QAuthenticator NTLM OOB Read in QNetworkAccessManager
CVE-2026-105946
5.3 - Medium
- October 27, 2026
Out-of-bounds read in the QAuthenticator NTLM authentication handling in the Qt Network module in Qt Group Qt allows remote attackers to obtain sensitive information (heap memory contents) or cause a denial of service (application crash) via a crafted NTLM challenge sent by a malicious server or proxy, when an application using QNetworkAccessManager or QTcpSocket authenticates with NTLM.
Out-of-bounds Read
Qt Core CBOR OOB Read via QCborValue::fromCbor() (CVE-2026-107157)
CVE-2026-107157
2 - Low
- October 26, 2026
Specially crafted CBOR input passed to QCborValue::fromCbor() in Qt Core can cause an out-of-bounds read, which may crash the application and could expose information.
Out-of-bounds Read
Qt QNetworkAccessManager Null Ptr via HTTP/2 RST_STREAM + PUSH_PROMISE
CVE-2026-96432
2.1 - Low
- October 26, 2026
A malicious or compromised HTTP/2 server withholding SETTINGS ACK can send RST_STREAM on a completed stream, planting a null pointer, and then send a PUSH_PROMISE for that stream, causing a null pointer dereference in the QNetworkAccessManager class of the Qt Network module that crashes the application.
NULL Pointer Dereference
Qt QXmlStreamReader XML DoS via CPU Exhaustion
CVE-2026-16762
8.7 - High
- October 23, 2026
An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity no data disclosure, data modification, or code execution and the impact is contained to the affected process.
Inefficient Algorithmic Complexity
An out-of-bounds memory access in the generateDirectionalRuns() function in qtextengine.cpp in Qt qtbase 5.11.x and 5.12.x before 5.12.5
CVE-2019-18281
- October 23, 2019
An out-of-bounds memory access in the generateDirectionalRuns() function in qtextengine.cpp in Qt qtbase 5.11.x and 5.12.x before 5.12.5 allows attackers to cause a denial of service by crashing an application via a text file containing many directional characters.
