CVE-2026-100140

access.redhat.com • November 2, 2026

CWE data temporarily unavailable CWE data is currently experiencing intermittent outages, which may cause incomplete section loading on CVE pages. We are actively working on a fix.

A flaw was found in Qt. An integer overflow vulnerability exists in the XML (Extensible Markup Language) parsing functionality within the QXmlSimpleReader component. A local attacker could exploit this flaw by enticing a user or application to process specially crafted XML input. Successful exploitation leads to memory corruption, causing an application crash and resulting in a Denial of Service (DoS).

Bugzilla 2565128 : qt6: Integer overflow vulnerability in XML parsing functionality of Qt5Compat impacts Qt

CWE-190 : Integer Overflow or Wraparound

Frequently Asked Questions

"Under investigation" doesn't necessarily mean that the product is affected by this vulnerability. It only means that our Analysis Team is still working on determining whether the product is affected and how it is affected.

The term 'Affected' means that our Analysis team has determined that this product, such as Red Hat Enterprise Linux 8 or OpenShift Container Platform 4, is affected by this vulnerability and a fix may be released to address this issue in the near future. This includes all minor releases of this product unless noted otherwise in the Statement text.

Upgrade to a supported product version that includes a fix for this vulnerability (recommended).

Apply a mitigation (if one exists).

Customers with the Technical Account Manager (TAM) RHEL Security Select Add-on can review this CVE directly with their TAM.

Apply a mitigation (if one exists).

Red Hat Engineering focuses on addressing high-priority issues based on the impact and product lifecycle expectations. Therefore, lower-priority issues will not receive immediate fixes.

Customers with the technical account manager (TAM) RHEL Security Select Add-on can review this CVE directly with their TAM.

Not sure what something means? Check out our Security Glossary .

For clarification or corrections, please Red Hat Product Security .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Integer Overflow Vulnerability in Qt XML Parsing (CVE-2026-100140) An integer overflow vulnerability (CVE-2026-100140) has been identified in the XML parsing functionality of Qt5Compat, affecting versions 6.0.0 through 6.8.9, 6.9.0 through 6.11.2, and 6.12.0. An unauthenticated attacker can exploit this flaw by providing specially crafted XML input, potentially leading to memory corruption and application crashes, resulting in a Denial of Service (DoS). Currently, there is no evidence of or public proof-of-concept code. Patches are available for affected versions, and users are advised to upgrade to Qt 6.8.10, 6.11.3, or 6.12.1 or later. Input validation and sanitization for XML data from untrusted sources is also recommended. The CVSS score assigned to this vulnerability is 1.9, indicating a low severity level. 1 sources 31

Extracted Entities

CVE-2026-100140

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (1)