Read the docs
TI-2026-76741 Aliases CVE-2026-101201GHSA-7cv7-2mxj-57c6

Integer overflow leads to out-of-bounds read in Qt binary JSON parser

Priority LOW 19CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-125 and the CVSS impact.

Summary

Qt from 5.0.0 through 6.8.8 and from 6.9.0 through 6.11.2 is affected. A malformed header in a binary file passed to QBinaryJson::fromBinaryData() causes an out-of-bounds read (CWE-125). A local attacker with no privileges can cause undefined behaviour and disrupt availability if a user opens the crafted binary file.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

A malformed header in the binary file fed to QBinaryJson::fromBinaryData() can cause undefined behaviour because of out-of-bounds read.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00163 5th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
qtqt5.0.0 – 6.8.8; 6.9.0 – 6.11.2—No fix listedCNA
  • qt Vendorqt Affected 5.0.0 – 6.8.8; 6.9.0 – 6.11.2 Fixed in — No fix listed CNA

CPE names CNA · 3

CPEVersionsRoleVendor
cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*——qt
cpe:2.3:a:qt:qt5compat:*:*:*:*:*:*:*:*——qt
cpe:2.3:a:qt:qtbase:*:*:*:*:*:*:*:*——qt
  • cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:* Versions — — ·qt
  • cpe:2.3:a:qt:qt5compat:*:*:*:*:*:*:*:* Versions — — ·qt
  • cpe:2.3:a:qt:qtbase:*:*:*:*:*:*:*:* Versions — — ·qt

Remediation

The sources list no fixed version for qt. Red Hat lists Red Hat Enterprise Linux 7, 8, 9 and 10 and Red Hat Hardened Images as affected with no fix available.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 7AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat Hardened ImagesAffectedNo fix yet
Not affected: 1 product
  • Red Hat Hardened Images

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-101201
  2. 2026-10-20 Alias added: GHSA-7cv7-2mxj-57c6
  3. 2026-10-20 Affected versions changed · Red Hat
  4. 2026-10-20 CVSS score added · Red Hat
  5. 2026-10-20 CISA SSVC decision points changed
  6. 2026-10-24 Affected versions changed · Red Hat

References

Patch 2

Advisory 1

  • TI-2024-23902 QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x… CVSS 3.1CRITICAL 9.8
  • TI-2022-21359 Heap-based buffer overflow in Qt CVSS 3.1HIGH 8.8
  • TI-2022-19524 Integer overflow in Qt CVSS 3.1HIGH 8.8
  • TI-2023-18997 In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can… CVSS 3.1HIGH 7.5
  • TI-2021-09305 Integer Overflow vulnerability in qsvghandler.cpp in Qt qtsvg versions 5.15.1, 6.0.0… CVSS 3.1MEDIUM 5.5
  • TI-2023-28356 An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before… CVSS 3.1CRITICAL 9.8
See all 106 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences