Log in Start free

Vulnerability · Published Oct 21, 2026 · Assigned by Qt

CVE-2026-105923Null-pointer dereference in QTriangulator reachable through VectorImage

Medium 4.0

In plain English

A medium-severity null pointer dereference in Qt from qt. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).

Severity (CVSS 4.0)4.0Medium
Exploit odds (30 days)0.1%top 98.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in VectorImage QML Type.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12qt6-baseno fix listedDEBIAN-CVE-2026-105923
Debian:13qt6-baseno fix listedDEBIAN-CVE-2026-105923
Debian:14qt6-baseno fix listedDEBIAN-CVE-2026-105923
Debian:12qtbase-opensource-srcno fix listedDEBIAN-CVE-2026-105923
Debian:13qtbase-opensource-srcno fix listedDEBIAN-CVE-2026-105923
Debian:14qtbase-opensource-srcno fix listedDEBIAN-CVE-2026-105923
Debian:12qtbase-opensource-src-glesno fix listedDEBIAN-CVE-2026-105923
Debian:13qtbase-opensource-src-glesno fix listedDEBIAN-CVE-2026-105923
Debian:14qtbase-opensource-src-glesno fix listedDEBIAN-CVE-2026-105923
Ubuntu:22.04:LTSqtbase-opensource-src-glesno fix listedUBUNTU-CVE-2026-105923
Ubuntu:24.04:LTSqtbase-opensource-src-glesno fix listedUBUNTU-CVE-2026-105923
Ubuntu:26.04:LTSqtbase-opensource-src-glesno fix listedUBUNTU-CVE-2026-105923
Ubuntu:26.10qtbase-opensource-src-glesno fix listedUBUNTU-CVE-2026-105923

Affected products (as reported)

VendorProductVersions
qt Qt 6.8.0 – before 6.8.96.9.0 – before 6.11.3

Weakness: CWE-476, CWE-190 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/RE:L/U:Green

References