Qt CoAP EUVD-2026-115724

The affected application must use the Qt CoAP module and must parse a CoAP message supplied by the attacker through QCoapInternalReply::createFromFrame() - i.e. the application has to be acting as a CoAP endpoint/client that accepts and decodes incoming CoAP frames. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is required once such traffic can reach the parser. Limiting factors: exposure is confined to deployments that both link the Qt CoAP module and expose CoAP message parsing to attacker-controllable input; the stated impact is primarily a crash (availability) and operating on incorrect data (low integrity), with no confidentiality/disclosure impact claimed (VC:N), and exploit maturity is unreported.

The signals are internally consistent and point to a genuine but moderate-severity availability issue rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) describes a remote, low-complexity, unauthenticated trigger, which raises reachability, but the impact metrics are deliberately narrow: VA:H (crash / loss of availability) with only VI:L (operating on incorrect data) and VC:N - so despite this being an out-of-bounds READ (CWE-125), the vendor asserts no confidentiality/information-disclosure impact. Exploit maturity is E:U (unreported), there is no CISA KEV listing, and no PoC or exploit reference appears in the input (only vendor advisory and patch links), so the correct reading is no public exploit identified at time of analysis. EPSS is not provided, so widespread-exploitation probability cannot be quantified from the data. AU:Y indicates the trigger is automatable, which modestly raises concern, but the vuln.today decision label is this_month (not act_now/emergency), matching the overall picture of a patch-this-cycle issue rather than a drop-everything one. Note the limited real-world exposure driver: only applications that actually use the Qt CoAP module and parse attacker-reachable CoAP traffic are affected.

An attacker who can send CoAP traffic to an application built on the Qt CoAP module transmits a malformed CoAP message that is parsed by QCoapInternalReply::createFromFrame(). The resulting out-of-bounds read causes the application to crash (denial of service) or to continue running on corrupted data. No public exploit code is identified at time of analysis; exploit maturity is unreported (E:U).