Qt5Compat QXmlSimpleReader CVE-2026-100140

Exploitation requires an application that still uses the deprecated Qt5Compat QXmlSimpleReader XML parser (not Qt's default/modern XML stream readers), and the victim must actively parse an attacker-crafted XML document - the vector is local (AV:L) with required user interaction (UI:P) and a specific attack requirement (AT:P), not remote-unauthenticated-at-default. Limiting factors that reduce realistic risk: the affected code is a legacy Qt5 compatibility module rather than core Qt, no privileges are gained (impact is availability-high with only low integrity and no confidentiality), exploitation is rated unproven, and the attacker cannot act purely remotely without getting the malicious input parsed on the target.

All available signals converge on this being a genuinely low-priority issue rather than a high-CVSS item masquerading as low risk - the CVSS itself is low (1.9, CVSS 4.0). The vendor-supplied CVSS 4.0 vector is local (AV:L) with an attack requirement (AT:P) and required user interaction (UI:P), yielding no confidentiality impact (VC:N), only low integrity impact (VI:L), and high availability impact (VA:H) - i.e. the practical outcome is a denial of service (crash) when a crafted XML document is parsed, consistent with CWE-190 integer overflow. Exploit maturity is explicitly E:U (exploitation unproven), there is no CISA KEV listing, and no EPSS score was supplied in the input, so exploitation probability cannot be quantified from the data given. The vuln.today decision label is 'monitor', which aligns with the low score and unproven exploitation. No PoC or exploit reference is present - every reference is either the Qt wiki advisory or a Qt code-review patch commit - so there is no public exploit identified at time of analysis. The signals are mutually consistent (low severity, unproven exploitation, local+UI-gated, availability-only impact); the only notable gap is the absent EPSS score, which prevents an independent probability cross-check.

An attacker crafts a malicious XML document and induces a victim to open or process it within an application that uses the deprecated Qt5Compat QXmlSimpleReader parser; the integer overflow is triggered during parsing and most plausibly crashes the application (denial of service). Because the attack vector is local and user interaction is required, the attacker must get the crafted input in front of a victim who actively parses it. No public exploit code was identified, and exploitation is rated unproven (E:U).