Qt For Mcus
Monthly
Out-of-bounds read in Qt for MCUs occurs when an application passes a Latin-1-optimized string containing Latin-1 characters into the QML String.arg() formatting function, causing an incorrect buffer size calculation that yields incorrect formatting output and out-of-bounds memory reads. The vendor rates this 8.8 (CVSS 4.0) with high availability impact, and the vendor vector indicates unauthenticated (PR:N) network exploitation with no user interaction (UI:N), though practical exploitation is limited by the specific Latin-1 encoding precondition and the need for attacker-influenced data to actually reach String.arg() in embedded MCU firmware. No public exploit identified at time of analysis.
Heap memory corruption in Qt for MCUs (Qt Quick Ultralite) can produce a double free, invalid free, or use-after-free when an application passes text stored in a std::string into the public Qul::String interface, because the conversion copies the pointer without taking ownership and two objects subsequently release the same allocation. The assessed impact is high integrity and availability loss with only limited confidentiality exposure, and exploitation requires that the target application actually use this specific std::string-backed API pattern - no privileges or user interaction are otherwise needed. The vendor rates it 6.5 (Medium) under CVSS 4.0 with attack requirements present (AT:P); no public exploit code or confirmed active exploitation was identified at time of analysis, and the reference set provides only a Qt wiki advisory listing rather than a fix version.
Device halt - an availability-only denial of service - in Qt for MCUs is triggered when a Text element rendering styled (rich) text encounters an <img> tag with an attribute whose value is empty, causing an internal validation check to fail and the default error handler to abort execution. Per the CVSS vectors (PR:N/UI:N) the trigger is reachable without authentication or user interaction, but exposure is conditional: only applications that parse styled markup and allow attacker-influenced text into the Text element are affected, and plain-text Text elements are not. There is no code execution, data disclosure, or integrity impact, and no public exploit has been identified at time of analysis (CVSS E:U).
Out-of-bounds read in Qt for MCUs occurs when an application passes a Latin-1-optimized string containing Latin-1 characters into the QML String.arg() formatting function, causing an incorrect buffer size calculation that yields incorrect formatting output and out-of-bounds memory reads. The vendor rates this 8.8 (CVSS 4.0) with high availability impact, and the vendor vector indicates unauthenticated (PR:N) network exploitation with no user interaction (UI:N), though practical exploitation is limited by the specific Latin-1 encoding precondition and the need for attacker-influenced data to actually reach String.arg() in embedded MCU firmware. No public exploit identified at time of analysis.
Heap memory corruption in Qt for MCUs (Qt Quick Ultralite) can produce a double free, invalid free, or use-after-free when an application passes text stored in a std::string into the public Qul::String interface, because the conversion copies the pointer without taking ownership and two objects subsequently release the same allocation. The assessed impact is high integrity and availability loss with only limited confidentiality exposure, and exploitation requires that the target application actually use this specific std::string-backed API pattern - no privileges or user interaction are otherwise needed. The vendor rates it 6.5 (Medium) under CVSS 4.0 with attack requirements present (AT:P); no public exploit code or confirmed active exploitation was identified at time of analysis, and the reference set provides only a Qt wiki advisory listing rather than a fix version.
Device halt - an availability-only denial of service - in Qt for MCUs is triggered when a Text element rendering styled (rich) text encounters an <img> tag with an attribute whose value is empty, causing an internal validation check to fail and the default error handler to abort execution. Per the CVSS vectors (PR:N/UI:N) the trigger is reachable without authentication or user interaction, but exposure is conditional: only applications that parse styled markup and allow attacker-influenced text into the Text element are affected, and plain-text Text elements are not. There is no code execution, data disclosure, or integrity impact, and no public exploit has been identified at time of analysis (CVSS E:U).