Qt Framework EUVD-2026-109801

Exploitation requires that a Qt application deserialize attacker-supplied CBOR data through QCborValue::fromCbor(); the attacker must get malformed CBOR input into that code path. Per the CVSS vector, exploitation is further limited by AV:L (local vector as assessed by the vendor), AC:H (a non-trivial condition the attacker does not fully control), and UI:P (a legitimate user must perform an action, such as opening the crafted data, for the parse to occur). The exact configuration or input channel that triggers the out-of-bounds read is not described in the available sources, so whether network-delivered CBOR is reachable depends on the specific embedding application.

This is a low-priority issue, and the available signals agree on that. The vendor-supplied CVSS 4.0 base score is 2.0 (Low), driven by AV:L (local), AC:H (high attack complexity), UI:P (passive user interaction required) and an impact limited to confidentiality (VC:H) and availability (VA:H) with no integrity effect - consistent with an out-of-bounds read (CWE-125) that can leak adjacent memory or crash the process but not corrupt it. The CVSS exploit-maturity metric is E:U (unproven), there is no CISA KEV listing, no EPSS score was provided in the input, and the only exploit-relevant reference is the upstream patch, not proof-of-concept code. The vuln.today decision label is 'monitor,' which matches a low-severity, unproven-exploitation finding. One signal worth verifying: the attack vector is AV:L, but QCborValue::fromCbor() parses a serialization format that an application may well feed from network input, in which case real-world reachability could be closer to remote - the supplied sources do not describe how the malformed CBOR reaches the parser, so the local-only framing should be confirmed against the specific application's data flow. EPSS is absent rather than low, so no probabilistic exploitation estimate is available.

An attacker crafts a malformed CBOR payload and gets a Qt-based application to parse it via QCborValue::fromCbor() - for example by supplying a CBOR file or message the application is expected to open. The out-of-bounds read then leaks adjacent process memory to an output the attacker can observe, or crashes the application (denial of service). No public exploit code is identified at the time of analysis, and the CVSS vector indicates high attack complexity plus user interaction, so reliable exploitation is not trivial.