Qt MQTT EUVD-2026-115111

Exploitation requires the application to use the Qt MQTT module's QMqttClient and to establish an MQTT 5 (protocol version 5) connection under a specific combination of connection settings between client and server - the description states the corruption occurs only 'under certain MQTT 5 connection settings', so MQTT 3.1.1 connections and other setting combinations are not indicated to be affected. The CVSS AT:P and UI:P metrics confirm the crash is not reproducible against arbitrary/default interactions and depends on these particular negotiated conditions. Limiting factors: the only consequence is a client-side crash (availability loss, VA:H; no data exposure or integrity impact), the exact triggering settings are not documented in the available sources, and the issue affects client-side Qt-based applications rather than a widely exposed server surface.

This is a low-priority, high-noise-resistant issue, and the signals are internally consistent rather than conflicting. The CVSS 4.0 base metrics (AV:N/AC:L/AT:P/PR:N/UI:P) yield a low score of 2.3 because the only impact is availability (VA:H; VC:N/VI:N - no confidentiality or integrity loss), i.e. an application crash rather than code execution, despite the CWE-787 (out-of-bounds write) classification. The threat metrics reinforce low urgency: E:U indicates exploitation is unreported, there is no CISA KEV listing, no EPSS score was supplied, and no public exploit identified at time of analysis (the references contain only a vendor advisory and the patch changeset, not a PoC). The vuln.today decision label is 'monitor', which aligns with the low severity and absence of exploitation signals. The AT:P (attack requirements present) and UI:P metrics indicate the crash only manifests under 'certain MQTT 5 connection settings between client and server', not in arbitrary conditions. Net: a genuine but minor denial-of-service/robustness defect in a client library, appropriately rated low - not an emergency, and a patch is already available.

An application built on the Qt MQTT module connects as a QMqttClient to an MQTT 5 broker; when a specific combination of MQTT 5 connection settings is in play between client and server, QMqttClient corrupts its own memory and the host application crashes. A malicious or misconfigured broker (or a man-in-the-path influencing connection parameters) could deliberately induce this crash, causing denial of service on the client. No public exploit identified at time of analysis, and the only observed impact is a crash, not code execution.