{"id":"CVE-2026-94370","title":"A defect in the Qt for MCUs core string handling causes heap memory corruption","summary":"A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion t…","severity":"none","cwe":["CWE-415","CWE-416","CWE-590","CWE-665"],"published":"2026-10-14","updated":"2026-10-14","sourceUpdated":"2026-10-14T06:17:07.070","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-94370","references":[{"url":"https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-94370:","label":"a59d8014-47c4-4630-ab43-e1b13cbe58e3"}],"tags":["nvd"],"ingestedAt":"2026-10-14T07:21:04.831Z","slug":"CVE-2026-94370","body":"## Overview\n\nA defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion to the internal string type copies the pointer without taking ownership of it. Two objects then release the same memory, producing a double free, an invalid free, or a use-after-free.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}