Qt for MCUs CVE-2026-95509

Requires a Qt for MCUs application that passes a Latin-1-optimized string containing Latin-1 characters into the QML String.arg() formatting function; the bug only triggers on that specific string optimization/character combination. Practical exploitation is LIMITED by the need for attacker-influenced data to actually reach String.arg() in the target application (integration-dependent, not a default network service), by the specific Latin-1 encoding precondition, and by the affected product being embedded MCU firmware rather than a general internet-facing server. The vendor vector claims no authentication or user interaction, but network reachability is application-specific and should be verified.

The single quantitative signal is the vendor (Qt) CVSS 4.0 base score of 8.8 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H). No EPSS score, no CISA KEV listing, and no public exploit are present in the input, so exploitation status is 'no public exploit identified at time of analysis'. The high score is driven mostly by VA:H (availability) plus low confidentiality/integrity from an out-of-bounds READ (CWE-125). Two signals should be treated skeptically: (1) AV:N/PR:N/UI:N implies remote, unauthenticated, zero-interaction exploitation, yet the root cause is a buffer-size miscalculation inside the QML String.arg() formatting path on a microcontroller GUI framework - reaching it network-unattended requires that attacker-influenced Latin-1 string data actually flow into String.arg(), which is application- and integration-specific rather than a default network-facing service; verify the network reachability claim with Qt. (2) VI:L (integrity impact) is questionable for a pure read primitive and likely reflects corrupted/incorrect rendered output rather than true data tampering. Net: this is a real memory-safety defect worth patching in affected embedded builds, but the '8.8' is a vendor self-assessment whose network/unauthenticated framing overstates real-world reachability for most deployments. Absent EPSS/KEV/POC, this is not evidence of active or imminent widespread exploitation.

In a Qt for MCUs application that formats attacker-influenced text through QML String.arg() where the string is Latin-1-optimized and contains Latin-1 characters, the incorrect buffer-size calculation causes the formatter to read past the buffer. This can leak adjacent memory contents into the rendered/returned output or crash the application on the microcontroller. No public proof-of-concept is identified in the provided data.