Vulnerability · Published Sep 29, 2026 · Assigned by Qt
CVE-2026-95509Out-of-bounds read vulnerability in string formatting impacts Qt for MCUs
High 8.8
In plain English
A high-severity out-of-bounds read in Qt for MCUs from qt. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Severity (CVSS 4.0)8.8High
Exploit odds (30 days)0.3%top 75.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Strings optimized for Latin-1 displaying Latin-1 characters cause incorrect String.arg() formatting by an incorrect buffer size calculation, causing out-of-bounds reading.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| qt | Qt for MCUs | 2.6.0 – before 2.11.32.12.0 – before 2.12.3 |
Weakness: CWE-125, CWE-131 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N