An integer overflow vulnerability in the Qt XML parsing (Qt5Compat / QXmlSimpleReader) functionality of Qt has been discovered and has been assigned the CVE id CVE-2026-100140.

Affected versions: from Qt 6.0 to Qt 6.8.9, from Qt 6.9.0 to Qt 6.11.2, Qt 6.12.0

Impact: Processing a specially crafted XML document may trigger an integer overflow in the XML parser. This may lead to incorrect internal memory handling. In the worst case this can result in an application crash (denial of service) or data corruption.

CVSS 4.0 Score: 1.9 (Low)

Vector String: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/R:U

Mitigation: Validate or reject unreasonably large XML input before parsing.

Solution: Apply the following patches or update to Qt 6.8.10, Qt 6.11.3, Qt 6.12.1 or later.

Share with your friends

Related Articles

Security advisory: CVE-2026-111487: Out-of-bounds write vulnerability in the assimp scene import plugin of Qt3D impacts Qt Framework

An out-of-bounds write vulnerability in the…