Skip to content
Integer Overflow Vulnerability in Qt XML Parsing (CVE-2026-100140)

Integer Overflow Vulnerability in Qt XML Parsing (CVE-2026-100140)

First seen 2 Nov 2026, 18:43 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 2, 2026 at 19:47 UTC
  • •CVE-2026-100140 affects multiple Qt versions due to an integer overflow vulnerability.
  • •Exploitation can lead to memory corruption and application crashes, causing Denial of Service.
  • •Patches are available, and users are urged to upgrade to secure versions.

An integer overflow vulnerability (CVE-2026-100140) has been identified in the XML parsing functionality of Qt5Compat, affecting versions 6.0.0 through 6.8.9, 6.9.0 through 6.11.2, and 6.12.0. An unauthenticated attacker can exploit this flaw by providing specially crafted XML input, potentially leading to memory corruption and application crashes, resulting in a Denial of Service (DoS). Currently, there is no evidence of or public proof-of-concept code. Patches are available for affected versions, and users are advised to upgrade to Qt 6.8.10, 6.11.3, or 6.12.1 or later. Input validation and sanitization for XML data from untrusted sources is also recommended. The CVSS score assigned to this vulnerability is 1.9, indicating a low severity level.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-11-02
CVE-2026-100140 published
An integer overflow vulnerability in Qt XML parsing functionality was disclosed, affecting multiple versions.
Feedly
2026-11-02
Security advisory released
Qt issued a security advisory detailing the vulnerability and recommended patches for affected versions.
Qt Blog
2026-11-02
RedHat advisory published
RedHat confirmed the vulnerability and indicated that affected products may require updates.
RedHat

More articles in this cluster (4)

Following this threat?

Track CVE-2026-100140 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (6)

1 / 3

Common questions

Which versions of Qt are affected?
Qt versions 6.0.0 through 6.8.9, 6.9.0 through 6.11.2, and 6.12.0 are affected.
Is there evidence of active exploitation?
No, there is currently no evidence of active exploitation or public proof-of-concept code.
What should I do to protect my applications?
Upgrade to patched versions (6.8.10, 6.11.3, or 6.12.1) and implement input validation for XML data.