CVE-2026-94370

A flaw was found in Qt for MCUs. When an application processes text through the Qt Quick Ultralite string interface, memory references are copied without transferring ownership. This condition causes the application to improperly release or reuse memory, leading to heap memory corruption. An attacker could exploit this vulnerability by providing crafted text input, potentially resulting in arbitrary code execution or a denial of service (DoS) caused by an application crash.

This vulnerability is rated with an Important impact because heap corruption flaws can be triggered remotely without privileges to crash applications or potentially alter memory state. However, the vulnerable string handling logic is isolated to Qt Quick Ultralite within the Qt for MCUs offering, which is not packaged or utilized in Red Hat Enterprise Linux. Typical Red Hat deployments rely exclusively on standard Qt libraries, which do not include this embedded runtime and are therefore unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.