Qt For Mcus vulnerabilities

3 vulnerabilities

Known vulnerabilities in Qt For Mcus, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.5CVE-2026-94370qtqt_for_mcus
EPSS score
0.33%
A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion to the internal string type copies the pointer without taking ownership of it. Two objects then release the same memory, producing a double free, an invalid free, or a use-after-free.6.6CVE-2026-19395qtqt_for_mcus+8
EPSS score
0.25%
In Qt for MCUs, a Text element that displays styled text halts the device if an <img> tag in the text contains an attribute with an empty value. The text parser passes the empty value to an internal check that only accepts non-empty values. The check fails and reports an error, and the default error handler halts the device.8.8CVE-2026-95509qtqt_for_mcus
EPSS score
0.31%
Strings optimized for Latin-1 displaying Latin-1 characters cause incorrect String.arg() formatting by an incorrect buffer size calculation, causing out-of-bounds reading.