Null-pointer dereference in QTriangulator reachable through VectorImage
Impact
Qt versions 6.8.0 to 6.8.9 and 6.9.0 to 6.11.3 have a null-pointer dereference weakness in QTriangulator, reachable through VectorImage, triggered by a malicious SVG causing an integer overflow. The impact is a null-pointer dereference. A malicious SVG is required to trigger the vulnerability.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
qt · Qt
Qt
2 ranges
qt · Qt
Qt
Compare with this publisher’s ranges. This does not inspect your installation.
affected
6.8.0 → before 6.8.9
python versions
6.9.0 → before 6.11.3
python versions
Other versions: unaffected
Product identifiers (CPE)
cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*cpe:2.3:a:qt:qtbase:*:*:*:*:*:*:*:*Original source description
A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in VectorImage QML Type.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-105923View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.