CVE-2026-95509: qt qt_for_mcus Out-of-bounds Read

Vulnerability summary

CVE-2026-95509 is a high (CVSS 8.8) Out-of-bounds Read vulnerability in qt qt_for_mcus. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 22.6% of scored vulnerabilities.

Timeline

1. 29-09-2026
   PublishedVulnerability first disclosed.
2. 29-09-2026
   Last modifiedVulnerability information updated.

Description

Strings optimized for Latin-1 displaying Latin-1 characters cause incorrect String.arg() formatting by an incorrect buffer size calculation, causing out-of-bounds reading.

• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.
• CWE-131Incorrect Calculation of Buffer SizeThe product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.