Qt for MCUs CVE-2026-94370

Exploitation requires that the target application pass text into Qt Quick Ultralite through the public Qul::String interface where the source text is held in a std::string - this specific API usage is the trigger, reflected by the vector's AT:P (attack requirement present). The double free/invalid free/use-after-free arises because the std::string-to-internal-string conversion copies the pointer without taking ownership, so two objects later release the same heap allocation. Limiting factors: the attacker must be able to influence the text that reaches this exact code path, the application must use the vulnerable std::string pattern (not all Qul::String usage qualifies), and affected versions are unspecified (wildcard CPE) so patched builds are out of scope. No privileges or user interaction are required (PR:N/UI:N) once attacker-influenced text can reach the vulnerable API.

The vendor-supplied CVSS 4.0 vector (6.5, Medium) presents a mixed risk picture that argues against treating this as an urgent, broadly-exploitable network flaw. The vector shows AV:N/PR:N/UI:N - remote, unauthenticated, no user interaction - which inflates the raw score, but the critical qualifier is AT:P (attack requirement present): exploitation is only possible when an application actually passes attacker-influenced text into Qul::String via a std::string, so the network vector is really a proxy for 'attacker-controlled text reaches a specific, non-universal API usage pattern.' Impact signals (VC:L/VI:H/VA:H, plus subsequent-system SA:H) are consistent with a heap double-free/use-after-free that can cause crashes (DoS) and potentially memory-corruption-driven code execution on the MCU, but with limited direct confidentiality loss. Exploit maturity is E:U (Unreported) and there is NO KEV listing and NO public POC in the provided data, so by the input's own precision rules this is 'no public exploit identified at time of analysis.' In short: this is a legitimate memory-safety defect worth patching, not a drop-everything emergency - the headline AV:N overstates reach because AT:P plus the narrow Qul::String/std::string trigger condition and the niche MCU footprint sharply limit real-world mass exploitation. Note the mild internal tension: the vector is 4.0 (no CVSS 3.1 was provided), so cross-framework comparison relies on mapping AT:P to 3.1 AC:H rather than on an independent 3.1 source.

An attacker supplies crafted text (e.g., via a network-facing input, display string, or message field) to an embedded device whose firmware renders it through Qt Quick Ultralite using a Qul::String constructed from a std::string. Because the conversion copies the pointer without taking ownership, two objects release the same heap buffer, triggering a double free or use-after-free that crashes the device or, with careful heap grooming, corrupts memory toward code execution. No public exploit code is known, and success is conditional (AT:P) on the application genuinely using the vulnerable std::string-to-Qul::String path with attacker-influenced data.