CVE-2026-105923

Awaiting Analysis Awaiting Analysis - Queue

Integer Overflow in VectorImage QML Type

Publication date: 2026-10-21

Last updated on: 2026-10-29

Assigner: TQtC

Description

A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in VectorImage QML Type.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-29

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-105923

EUVD

EUVD-2026-107159

Affected Vendors & Products

Vendor	Product	Version / Range
qt	Qt	6.8.0
qt	Qt	6.9.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability involves a malicious SVG file causing an integer overflow, which then leads to a null-pointer dereference in the VectorImage QML Type. This flaw can crash applications or potentially allow code execution.

Detection Guidance

This vulnerability involves a malicious SVG triggering an integer overflow and null-pointer dereference in the VectorImage QML Type. Detection requires inspecting SVG files and QML applications for malformed inputs or crashes during rendering. Monitor for application crashes when processing SVGs and check logs for null-pointer dereference errors.

Impact Analysis

An attacker could exploit this by tricking a user into opening a specially crafted SVG file, causing application crashes or unauthorized code execution on the affected system.

Compliance Impact

This vulnerability involves an integer overflow leading to a null-pointer dereference in VectorImage QML Type via malicious SVG files. It may allow denial-of-service or potential code execution, which could impact data integrity and availability. Compliance risks include potential violations of GDPR (data integrity/availability) or HIPAA (system reliability for protected health information) if exploited in systems handling regulated data.

Mitigation Strategies

Update Qt to the latest patched version to address the integer overflow and null-pointer dereference in VectorImage QML Type.

Hi! I’m here to help you understand CVE-2026-105923. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...