---
id: CVE-2026-101201
title: >-
  qt6: qt: Denial of Service via out-of-bounds read in QBinaryJson
  (CVE-2026-101201)
summary: >-
  A flaw was found in Qt. An out-of-bounds read vulnerability can occur when
  parsing a binary file with a malformed header in the
  QBinaryJson::fromBinaryData() function. An attacker could exploit this flaw by
  convincing a user or application…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-125
  - CWE-190
vendor: Red Hat
product: Red Hat Enterprise Linux 10
affected:
  - enterprise_linux 10
  - hardened_images
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T09:36:26+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101201.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101201.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-101201'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2556033'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-101201'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-101201'
  - url: 'https://codereview.qt-project.org/c/qt/qt5compat/+/758925'
  - url: 'https://codereview.qt-project.org/c/qt/qt5compat/+/759230'
  - url: >-
      https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-101201
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
scores:
  vendor: 5.5
  cna: 4.3
ingestedAt: '2026-10-20T12:05:07.357Z'
---

## Overview

A flaw was found in Qt. An out-of-bounds read vulnerability can occur when parsing a binary file with a malformed header in the QBinaryJson::fromBinaryData() function. An attacker could exploit this flaw by convincing a user or application to process a specially crafted binary file, causing the application to crash and resulting in a Denial of Service (DoS).

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Hardened Images · no fix planned: Red Hat Enterprise Linux 10, Red Hat Hardened Images · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101201.json)

**qt6: qt: Denial of Service via out-of-bounds read in QBinaryJson** — rated Moderate by Red Hat. Released 2026-10-20.

Affected:

- Red Hat Enterprise Linux 10
- Red Hat Hardened Images

No fix planned:

- Red Hat Enterprise Linux 10
- Red Hat Hardened Images

## Remediation

Fix deferred