CVE-2026-51106

Deferred Deferred - Pending Action

Denial of Service in qTox via Serialization Flaw

Publication date: 2026-08-26

Last updated on: 2026-09-09

Assigner: MITRE

Description

An issue in TokTok qTox v1.18.4 allows a local attacker to cause a denial of service via the src/persistence/serialize.cpp component

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-09-09

Generated

2026-09-16

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-51106

Affected Vendors & Products

Vendor	Product	Version / Range
toktok	qtox	1.18.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This vulnerability is a denial of service issue in TokTok qTox version 1.18.4. It is caused by a flaw in the src/persistence/serialize.cpp component, which could allow a local attacker to crash the application.

Detection Guidance

Check for crashes in qTox during startup, especially when loading profile settings. Inspect the qTox settings directory (~/.config/tox/) for suspicious <profile>.ini files. Monitor system memory usage spikes during qTox launch.

Impact Analysis

If exploited, this vulnerability could cause the qTox application to become unresponsive or crash, disrupting normal use. Since it requires local access, the impact is limited to users who have access to the affected system.

Compliance Impact

This vulnerability is a local denial of service issue in qTox v1.18.4, which does not directly impact compliance with standards like GDPR or HIPAA as it does not involve data breaches or unauthorized access.

Mitigation Strategies

Update qTox to the latest version beyond v1.18.4 to address the denial of service issue in src/persistence/serialize.cpp.

Hi! I’m here to help you understand CVE-2026-51106. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70