TI-2026-83775 Aliases CVE-2026-107457 GHSA-g94w-7rpc-xf8m

Memory corruption in QMqttClient impacts Qt MQTT

LOW 12CWE-129Published 2026-11-02 · Updated 2026-11-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: Present
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-129 and the CVSS impact.

Summary

The Qt MQTT module in Qt is affected from 5.12.0 through 6.8.8 and from 6.9.0 through 6.11.2. Under certain MQTT 5 connection settings, the QMqttClient class may corrupt memory through an out-of-bounds write (CWE-787), which can crash the application. A remote attacker without privileges, with user interaction, can trigger the crash.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

A memory corruption vulnerability in the QMqttClient class of the Qt MQTT module. Under certain MQTT 5 connection settings between client and server, QMqttClient may corrupt memory, which can cause the application to crash.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00263 18th percentileScored 2026-11-07

Fix Fixed Red Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
qt	Qt	5.12.0 – 6.8.8; 6.9.0 – 6.11.2	—	Patch available	CNA

Qt Vendorqt Affected 5.12.0 – 6.8.8; 6.9.0 – 6.11.2 Fixed in — Patch available CNA

CPE names CNA · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:qt:qt::::::::	—	—	qt
cpe:2.3:a:qt:qtmqtt::::::::	—	—	qt

cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:* Versions — — ·qt
cpe:2.3:a:qt:qtmqtt:*:*:*:*:*:*:*:* Versions — — ·qt

Remediation

Red Hat advisory RHSA-2026:89193 fixes this flaw in Red Hat Hardened Images. The sources list no fixed version for Qt.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Red Hat 1 advisory

RHSA-2026:89193 Released 2026-10-25 · Red Hat rating Moderate
Red Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images qt6-6.12.0-1.hum1@src, qt6-filesystem-6.12.0-1.hum1@aarch64, qt6-filesystem-6.12.0-1.hum1@s390x +7

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Hardened Images	Fixed	RHSA-2026:89193

Not affected: 1 product

Red Hat Hardened Images

Timeline

2026-11-02 Threatist record created from CVE-2026-107457
2026-11-02 Alias added: GHSA-g94w-7rpc-xf8m
2026-11-02 Affected versions changed · Red Hat
2026-11-02 CVSS score added · Red Hat
2026-11-02 CISA SSVC decision points changed
2026-11-03 Fix available: RHSA-2026:89193 · Red Hat
2026-11-03 Fix available: Red Hat Hardened Images · Red Hat
2026-11-04 Affected versions changed · Red Hat

References

Patch 1

https://codereview.qt-project.org/c/qt/qtmqtt/+/762286

Advisory 1

https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-107457:

TI-2024-23902 QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x… CVSS 3.1CRITICAL 9.8
TI-2022-21359 Heap-based buffer overflow in Qt CVSS 3.1HIGH 8.8
TI-2022-19524 Integer overflow in Qt CVSS 3.1HIGH 8.8
TI-2023-18997 In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can… CVSS 3.1HIGH 7.5
TI-2021-09305 Integer Overflow vulnerability in qsvghandler.cpp in Qt qtsvg versions 5.15.1, 6.0.0… CVSS 3.1MEDIUM 5.5
TI-2023-28356 An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before… CVSS 3.1CRITICAL 9.8

See all 106 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences