An integer overflow vulnerability in the Qt XML parsing (Qt5Compat / QXmlSimpleReader) functionality of Qt has been discovered and has been assigned the CVE id CVE-2026-100140. Affected versions: from Qt 6.0 to Qt 6.8.9, from Qt 6.9.0 to Qt 6.11.2, Qt 6.12.0
Impact: Processing a specially crafted XML document may trigger an integer overflow in the XML parser. This may lead to incorrect internal memory handling. In the worst case this can result in an application crash (denial of service) or data corruption. CVSS 4.0 Score: 1.9 (Low) Vector String: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/R:U Mitigation: Validate or reject unreasonably large XML input before parsing. Solution: Apply the following patches or update to Qt 6.8.10, Qt 6.11.3, Qt 6.12.1 or later. Patches: dev: https://codereview.qt-project.org/c/qt/qt5compat/+/768900 https://codereview.qt-project.org/c/qt/qt5compat/+/764751 https://codereview.qt-project.org/c/qt/qt5compat/+/768901 https://codereview.qt-project.org/c/qt/qt5compat/+/768902 Qt 6.8: https://codereview.qt-project.org/c/qt/tqtc-qt5compat/+/770943 https://codereview.qt-project.org/c/qt/tqtc-qt5compat/+/771955 https://codereview.qt-project.org/c/qt/tqtc-qt5compat/+/772655 https://codereview.qt-project.org/c/qt/tqtc-qt5compat/+/770944 or https://download.qt.io/archive/qt/6.8/CVE-2026-100140-qt5compat-6.8.zip Qt 6.11: https://codereview.qt-project.org/c/qt/qt5compat/+/770916 https://codereview.qt-project.org/c/qt/qt5compat/+/771924 https://codereview.qt-project.org/c/qt/qt5compat/+/772641 https://codereview.qt-project.org/c/qt/qt5compat/+/770917 or https://download.qt.io/official_releases/qt/6.11/CVE-2026-100140-qt5compat-6.11.zip Qt 6.12: https://codereview.qt-project.org/c/qt/qt5compat/+/770852 https://codereview.qt-project.org/c/qt/qt5compat/+/771864 https://codereview.qt-project.org/c/qt/qt5compat/+/771863 https://codereview.qt-project.org/c/qt/qt5compat/+/770851 or https://download.qt.io/official_releases/qt/6.12/CVE-2026-100140-qt5compat-6.12.zip Mahdi Belila Qt Group [https://www.qt.io/]<https://www.qt.io/> [https://www.facebook.com/qt/]<https://www.facebook.com/qt/> [https://twitter.com/qtproject]<https://twitter.com/qtproject> [https://www.linkedin.com/company/qtgroup/]<https://www.linkedin.com/company/qtgroup/> [https://www.youtube.com/QtStudios]<https://www.youtube.com/QtStudios> Confidential
_______________________________________________ Announce mailing list [email protected] https://lists.qt-project.org/listinfo/announce
-- Development mailing list [email protected] https://lists.qt-project.org/listinfo/development
