CVE-2026-107157

A flaw was found in Qt. An out-of-bounds read vulnerability exists in the QCborValue::fromCbor() function when parsing malformed Concise Binary Object Representation (CBOR) data. By convincing an application to process specially crafted CBOR input, an attacker could cause an application crash leading to a Denial of Service (DoS) or potentially read unauthorized memory, resulting in information disclosure.

An out-of-bounds read vulnerability was found in the Qt framework's QCborValue::fromCbor() function. When an application parses malformed Concise Binary Object Representation (CBOR) input, an attacker can trigger memory reads beyond the designated buffer boundaries. This flaw directly leads to an application crash (Denial of Service) or potential disclosure of unauthorized process memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Refactor application code to utilize the QByteArray overload of QCborValue::fromCbor() rather than pointer-and-size variants. Validate and enforce strict length constraints on untrusted CBOR payloads prior to parsing.