CVE-2026-103653

EUVD-2026-115724
An out-of-bounds read vulnerability in the Qt CoAP message parsing (QCoapInternalReply::createFromFrame()) of the Qt CoAP module. Processing a malformed CoAP message can cause an application using Qt CoAP to crash (loss of availability) or to continue operating on incorrect data (potential loss of integrity).
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
QtCNA
6.7 MEDIUM
NETWORK
LOW
NONE
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:L/U:Amber
Base Score
CVSS 3.x
EPSS Score
Percentile: 21.79%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
qtqt
5.13.0 ≤
𝑥
≤ 6.8.8
CNA
qtqt
6.9.0 ≤
𝑥
≤ 6.11.2
CNA
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://codereview.qt-project.org/c/qt/qtcoap/+/760652
https://codereview.qt-project.org/c/qt/qtcoap/+/761120
https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-103653: