What’s Vulnerable › Vulnerabilities

CVE-2026-105923: Null-pointer dereference in QTriangulator reachable through VectorImage

• Severity: medium (CVSS 4.0 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-21 · updated 2026-10-29
• Weakness: CWE-190

Description

A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in VectorImage QML Type.

Affected products

• Qt: from 6.8.0 before 6.8.9; from 6.9.0 before 6.11.3 — fixed in 6.8.9, 6.11.3

How to fix

Upgrade to a fixed version: Qt 6.8.9, 6.11.3. Check the vendor advisory for mitigations.

References

• https://codereview.qt-project.org/c/qt%2Fqtbase/+/762279
• https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products

Get alerted when CVE-2026-105923 or the next vulnerability affects your stack