CVE-2026-105923Medium· 4.0▾ SunlitA malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in VectorImage QML Type.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 22 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in VectorImage QML Type.
Qt >= 6.8.0 < 6.8.9Qt >= 6.9.0 < 6.11.3Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-101201Medium· 4.3QBinaryJson::fromBinaryData() integer overflow leading to OOB read
CVE-2023-51714Critical· 9.8An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2
CVE-2020-24742High· 7.8An issue has been fixed in Qt versions 5.14.0 where QPluginLoader attempts to load plugins relative to the working directory, allowing attackers to execute arbitrary code via crafted files.
CVE-2020-0570High· 7.3Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated user to potentially enable elevation of privilege via local access.
CVE-2026-79680Medium· 4.5Authentication bypass vulnerability in the password authentication mechanism of the Qt VNC Server module
CVE-2026-78253Low· 2.3Uncontrolled recursion in QXmlStreamReader::readElementText() in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted XML document.