{"id":"CVE-2026-107157","aliases":[],"title":"Out-of-bounds read vulnerability in QCborValue::fromCbor() impacts Qt Framework","titleSource":"Qt","descriptionSource":"Qt","products":[{"vendor":"qt","name":"Qt","platforms":["64 bit"],"versions":[{"version":"0","status":"unaffected","lessThan":"5.12.0","versionType":"python"},{"version":"5.12.0","status":"affected","lessThanOrEqual":"6.8.8","versionType":"python"},{"version":"6.9.0","status":"affected","lessThanOrEqual":"6.11.2","versionType":"python"}],"defaultStatus":"unaffected","source":"Qt","url":"https://www.cve.org/CVERecord?id=CVE-2026-107157"}],"remediation":[],"description":"Specially crafted CBOR input passed to QCborValue::fromCbor() in Qt Core can cause an out-of-bounds read, which may crash the application and could expose information.","severity":"low","score":2,"published":"2026-10-26T12:52:26.628Z","modified":"2026-10-27T07:52:45.806Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-107157:","https://codereview.qt-project.org/c/qt/qtbase/+/745719"],"sources":[{"name":"CVE","id":"CVE-2026-107157","modified":"2026-10-27T07:52:45.806Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-107157"}],"assessments":[{"source":"Qt","vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/RE:L/U:Amber","score":2}],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T20:15:32.897Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}