Qt qt5compat EUVD-2026-104838

Exploitation requires that the target application use Qt's deprecated qt5compat module and specifically call QBinaryJson::fromBinaryData() to parse attacker-supplied binary JSON data - this is a legacy Qt5 compatibility feature, not a default code path in modern Qt6 applications. The attack vector is local (AV:L): the attacker must get the malformed binary file to the victim, and per UI:P the victim must open or process that file for the flaw to trigger. Limiting factors: no remote network reach, mandatory victim interaction, and dependence on an application actively consuming the obsolete binary JSON format - applications that do not use QBinaryJson are not exposed regardless of Qt version.

This is a genuinely low-to-moderate priority issue, not a top-tier threat despite affecting the widely-used Qt framework. The vendor CVSS 4.0 vector (score 4.3) tells a consistent, low-urgency story: AV:L means the attacker needs local delivery of a crafted file rather than remote network reach, UI:P means a victim must passively open or process that file, and the impact is confined to availability (VA:H) with no confidentiality or integrity loss (VC:N/VI:N) - consistent with an out-of-bounds read that produces a crash or undefined behaviour rather than code execution or data theft. The exploit-maturity metric E:U (unproven) aligns with the absence of any KEV listing or public POC in the provided data, so there is no evidence of active exploitation. No EPSS score was provided, so probabilistic exploitation likelihood cannot be factored in - this is a data gap, not a signal of low risk. No SSVC decision data was supplied either. The one point worth flagging: CWE-190 (Integer Overflow) combined with 'out-of-bounds read' could in principle leak adjacent memory (a confidentiality concern), yet the vendor scored VC:N; the description only characterizes the result as 'undefined behaviour,' so the availability-only impact is plausible but the possibility of limited information disclosure cannot be fully excluded from the description alone. Overall: a low-CVSS, low-real-risk DoS-class bug gated behind local file delivery and use of a deprecated Qt feature.

An attacker crafts a binary JSON file with a malformed header and delivers it to a victim (e.g., as an email attachment or download) whose application uses Qt's legacy QBinaryJson::fromBinaryData() to parse it. When the victim opens the file, the malformed header triggers an integer-overflow-driven out-of-bounds read, causing undefined behaviour and most likely a crash of the host application. No public exploit identified at time of analysis, and exploitation requires local delivery plus victim interaction.