EUVD-2026-75974
GHSA-83vf-f8f4-pj48
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent vector for NFC proximity constraint; user interaction required to scan tag; no integrity impact; high availability from application crash on malformed input.
Primary rating from Vendor (Qt).
CVSS VectorVendor: Qt
Lifecycle Timeline
2DescriptionCVE.org
An out-of-bounds read in Qt NFC's language code length parsing allows a physically proximate attacker to cause a denial of service or limited memory disclosure via a crafted NFC tag.
AnalysisAI
Out-of-bounds read in Qt's NFC connectivity module (qtconnectivity) exposes applications to denial of service or limited process memory disclosure when parsing crafted NFC tags with malformed language code length fields. All Qt versions fall within the affected CPE scope, with the flaw residing in NDEF Text Record parsing logic invoked when a user scans a malicious tag. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | All of the following conditions must be met: (1) physical or near-physical proximity to the target device (NFC operates at ≤10 cm); (2) user interaction - the target must actively scan or present their device to the crafted tag (the CVSS 4.0 UI:A metric confirms this); (3) the target application must use Qt's qtconnectivity NFC module and invoke NDEF Text Record parsing; (4) the NFC feature must be active at the time of scanning. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H, score 6.9) captures the real threat model accurately: exploitation is hard-bounded by NFC radio range, requires user action, and yields either an application crash or a small, uncontrolled memory disclosure rather than arbitrary code execution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream patch submitted to Qt's code review system at codereview.qt-project.org/c/qt/qtconnectivity/+/743136, which corrects bounds validation on the language code length field during NDEF record parsing. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
setMarkdown in Qt before 5.14.2 has a use-after-free related to QTextMarkdownImporter::insertBlock. Rated critical sever
In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an application crash in QXmlS
Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles OpenSSL's error qu
Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated user to potential
QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, an
Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors. Rated cr
An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before
An issue was discovered in Qt before 5.11.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploita
Stack-based buffer overflow in QXmlSimpleReader in Qt 4.8.5 allows remote attackers to cause a denial of service (applic
An issue was discovered in Qt before 5.11.3. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,
QXmlStream in Qt 5.x before 5.11.3 has a double-free or corruption during parsing of a specially crafted illegal XML doc
Privilege escalation in the Qt Axivion Dashboard allows an authenticated low-privileged user to mint API tokens for othe
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today