CVE-2026-107457
Received Received - Intake

Memory Corruption in Qt MQTT QMqttClient

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: TQtC

Description
A memory corruption vulnerability in the QMqttClient class of the Qt MQTT module. Under certain MQTT 5 connection settings between client and server, QMqttClient may corrupt memory, which can cause the application to crash.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-107457

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
qt Qt 5.12.0
qt Qt 6.9.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.
CWE-129 The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a memory corruption vulnerability in the QMqttClient class of the Qt MQTT module. It occurs when certain MQTT 5 connection settings are used between a client and server, leading to memory corruption that can crash the application.

Detection Guidance

Detecting this vulnerability requires checking for crashes in applications using the Qt MQTT module during MQTT 5 connection attempts. Monitor application logs for segmentation faults or memory corruption errors. Inspect network traffic for malformed MQTT 5 protocol packets between clients and servers.

Impact Analysis

The vulnerability can cause applications using the Qt MQTT module to crash, potentially leading to denial of service. If exploited, it may disrupt services relying on MQTT for communication.

Compliance Impact

This vulnerability may impact compliance with GDPR and HIPAA due to potential application crashes caused by memory corruption. Such crashes could lead to denial of service or data exposure if exploited, which may violate availability and integrity requirements in these regulations.

Mitigation Strategies

Update the Qt MQTT module to the latest patched version to prevent memory corruption in QMqttClient during MQTT 5 connections.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107457. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...