Security advisory: CVE-2026-100140: Integer overflow vulnerability in XML parsing functionality of Qt5Compat impacts Qt Qt Blog / 9h An integer overflow vulnerability in the Qt XML parsing (Qt5Compat / QXmlSimpleReader) functionality of Qt has been discovered and has been assigned the CVE id CVE-2026-100140.

www.qt.io • November 2, 2026

Security advisory: CVE-2026-100140: Integer overflow vulnerability in XML parsing functionality of Qt5Compat impacts Qt

An integer overflow vulnerability in the Qt XML parsing (Qt5Compat / QXmlSimpleReader) functionality of Qt has been discovered and has been assigned the CVE id CVE-2026-100140.

from Qt 6.0 to Qt 6.8.9, from Qt 6.9.0 to Qt 6.11.2, Qt 6.12.0

Processing a specially crafted XML document may trigger an integer overflow in the XML parser. This may lead to incorrect internal memory handling. In the worst case this can result in an application crash (denial of service) or data corruption.

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/R:U

Validate or reject unreasonably large XML input before parsing.

Apply the following patches or update to Qt 6.8.10, Qt 6.11.3, Qt 6.12.1 or later.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Integer Overflow Vulnerability in Qt XML Parsing (CVE-2026-100140) An integer overflow vulnerability (CVE-2026-100140) has been identified in the XML parsing functionality of Qt5Compat, affecting versions 6.0.0 through 6.8.9, 6.9.0 through 6.11.2, and 6.12.0. An unauthenticated attacker can exploit this flaw by providing specially crafted XML input, potentially leading to memory corruption and application crashes, resulting in a Denial of Service (DoS). Currently, there is no evidence of or public proof-of-concept code. Patches are available for affected versions, and users are advised to upgrade to Qt 6.8.10, 6.11.3, or 6.12.1 or later. Input validation and sanitization for XML data from untrusted sources is also recommended. The CVSS score assigned to this vulnerability is 1.9, indicating a low severity level. 1 sources 31

Extracted Entities

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)