CVE Feed

    Dashboard / CVE / CVE-2026-103653

    CVE-2026-103653

    An out-of-bounds read vulnerability in the Qt CoAP message parsing (QCoapInternalReply::createFromFrame()) of the Qt CoAP module. Processing a malformed CoAP message can cause an application using Qt CoAP to crash (loss of availability) or to continue operating on incorrect data (potential loss of integrity).

    Published:Nov 3, 2026
    Last Modified:Nov 3, 2026
    EPS:Nov 3, 2026
    EPSS Score:0.00291
    CVSS Score:6.7

    Affected Products

    Vendor
    Qt
    Product
    Qt
    Vendor
    Qt
    Product
    Qtcoap

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-125 Out-of-bounds Read

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-540 Overread Buffers

    Related CVEs

    CVE-2026-107479 (CVSS 1.7) — An integer truncation vulnerability in the QTextCodec conversion functions of the Qt 5 Core Compatibility APIs…
    CVE-2026-110944 (CVSS 2.7) — Resource exhaustion vulnerability in the HTTP request handling of the QHttpServer component of Qt HTTP Server.…
    CVE-2026-100140 (CVSS 1.9) — An integer overflow vulnerability in the Qt XML parsing (Qt5Compat / QXmlSimpleReader) functionality of Qt.…
    CVE-2026-107457 (CVSS 2.3) — A memory corruption vulnerability in the QMqttClient class of the Qt MQTT module. Under certain MQTT 5 connect…
    CVE-2026-111487 (CVSS 4.3) — An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module.…
    CVE-2026-105924 (CVSS 4.3) — A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module.…
    CVE-2026-107590 (CVSS 1.9) — An out-of-bounds write vulnerability in the Qt QTextCodec iconv-based encoding of the Qt 5 Compatibility APIs …
    CVE-2026-107472 (CVSS 4.3) — An out-of-bounds read vulnerability in the QTextCodec TSCII encoding of the Qt 5 Compatibility APIs module (Qt…
    CVE-2026-105946 (CVSS 5.3) — Out-of-bounds read in the QAuthenticator NTLM authentication handling in the Qt Network module in Qt Group Qt …
    CVE-2026-107157 (CVSS 2) — Specially crafted CBOR input passed to QCborValue::fromCbor() in Qt Core can cause an out-of-bounds read, whic…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High