CVE-2026-107157
Description
A flaw was found in Qt. An out-of-bounds read vulnerability exists in the QCborValue::fromCbor() function when parsing malformed Concise Binary Object Representation (CBOR) data. By convincing an application to process specially crafted CBOR input, an attacker could cause an application crash leading to a Denial of Service (DoS) or potentially read unauthorized memory, resulting in information disclosure.
Statement
An out-of-bounds read vulnerability was found in the Qt framework's QCborValue::fromCbor() function. When an application parses malformed Concise Binary Object Representation (CBOR) input, an attacker can trigger memory reads beyond the designated buffer boundaries. This flaw directly leads to an application crash (Denial of Service) or potential disclosure of unauthorized process memory.
Mitigation
Refactor application code to utilize the QByteArray overload of QCborValue::fromCbor() rather than pointer-and-size variants. Validate and enforce strict length constraints on untrusted CBOR payloads prior to parsing.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.6 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | Required | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | Low | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | Low | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
