PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-107457 qt CVE debrief

A memory corruption vulnerability exists in the QMqttClient class of the Qt MQTT module. Under certain MQTT 5 connection settings between client and server, QMqttClient may corrupt memory, which can cause the application to crash. The CVSS score is 2.3, indicating a low severity vulnerability. This vulnerability could potentially impact systems utilizing the Qt MQTT module, especially if they rely on MQTT 5 connections. Defenders should assess the presence of this vulnerability in their implementations and consider the potential operational impacts, including application crashes and potential denial-of-service (DoS) attacks. The vulnerability's low severity score suggests that it

Vendor
qt
Product
Unknown
CVSS
LOW 2.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-11-02
Original CVE updated
2026-11-02
Advisory published
2026-11-02
Advisory updated
2026-11-02

Who should care

Defenders responsible for systems using the Qt MQTT module should assess the potential impact of this vulnerability and verify its presence in their implementations.

Why it matters

A low-severity memory corruption vulnerability exists in the Qt MQTT module, potentially causing application crashes under specific conditions. Defenders should verify the presence of this vulnerability in their systems and assess the potential impact.

  • Application crashes due to memory corruption
  • Potential denial-of-service (DoS) attacks
  • Need for verification of vulnerability presence in Qt MQTT module implementations
  • Potential for exploitation under specific MQTT 5 connection settings

Technical summary

The QMqttClient class in the Qt MQTT module is vulnerable to memory corruption under certain MQTT 5 connection settings. This can cause the application to crash. The vulnerability has a CVSS score of 2.3 and is considered low severity. The vulnerability arises from the way QMqttClient handles specific MQTT 5 connections, which can lead to memory corruption. Defenders should focus on verifying the presence of this vulnerability in their Qt MQTT module implementations and assessing the potential impact on their systems, especially in scenarios where MQTT 5 is used.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their Qt MQTT module implementations and assess the potential impact on their systems.

Recommended defensive actions

  • Verify the presence of this vulnerability in Qt MQTT module implementations
  • Assess the potential impact on systems using the Qt MQTT module
  • Review MQTT 5 connection settings to prevent exploitation

Evidence notes

The vulnerability is described in the CVE Program record and the NVD vulnerability detail page. The Qt Project is mentioned as a potential source of the Qt MQTT module.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-107457 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-107457

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-107457 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-107457

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://codereview.qt-project.org/c/qt/qtmqtt/+/762286

    a59d8014-47c4-4630-ab43-e1b13cbe58e3

  • Source reference

    Unverified legacy reference

    URL: https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products

    a59d8014-47c4-4630-ab43-e1b13cbe58e3

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.