CVE-2026-107590

An integer overflow vulnerability exists in the Qt XML parsing functionality (Qt5Compat / QXmlSimpleReader). It may cause incorrect parser behavior when processing crafted XML data.

Incomplete cleanup in Qt Network's Schannel support on Windows can lead to a Denial of Service over time. Affects Qt from 5.15.0 through 6.8.3 and from 6.9.0 before 6.9.2.

In the HTTP2 implementation in Qt before 5.15.17, 6.2.11, 6.5.4, and 6.6.2, there is an incorrect HPack integer overflow check in hpacktable.cpp.

A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module. It may lead to application crashes when processing CBOR data.

An out-of-bounds read vulnerability in the QTextCodec TSCII encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt. Applications that convert text to the TSCII encoding through QTextCodec may read memory outside the input buffer, which can cause the application to crash or misinterpret the data.

Specially crafted CBOR input passed to QCborValue::fromCbor() in Qt Core can cause an out-of-bounds read, which may crash the application and could expose information.

A malformed header in the binary file fed to QBinaryJson::fromBinaryData() can cause undefined behaviour because of an out-of-bounds read.

Uncontrolled recursion in QXmlStreamReader::readElementText() in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted XML document.

QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.

An out-of-bounds read vulnerability in QTextCodec::codecForName() in Qt. When called with a non-NUL-terminated QByteArray, the codec-name matching routine reads past the buffer. This usually results in incorrect codec selection; worst case, it causes a crash (DoS). Affects Qt5Compat module from Qt 6.0.0 and Qt Core in Qt 4.x and 5.x.