Integer Overflow Flaw Patched in Qt 6.0 through 6.12.0 XML Parser
The Qt Company has released patches for an integer overflow vulnerability in the Qt5Compat XML parser affecting Qt versions 6.0 through 6.12.0.
CVE-2026-100140 is an integer overflow in the Qt5Compat XML parser (QXmlSimpleReader) affecting Qt 6 versions 6.0 through 6.12.0, disclosed on November 2, 2026. Qt5Compat maintains older Qt 5 APIs in Qt 6, exposing projects that migrated from Qt 5 and continue using the old XML reader.
The advisory lists affected ranges as Qt 6.0 to 6.8.9, Qt 6.9.0 to 6.11.2, and Qt 6.12.0, carrying a CVSS 4.0 score of 1.9 with a Low rating. The vector is CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/R:U, indicating a local attack vector requiring user interaction, with high availability impact and low integrity impact.
A specially crafted XML document triggers the flaw, causing incorrect internal memory handling, application crashes resulting in a denial of service, or data corruption.
The Qt Company released fixed versions in Qt 6.8.10, Qt 6.11.3, and Qt 6.12.1. Patches are accessible for dev, 6.8, 6.11, and 6.12 branches via the Qt code review system, alongside downloadable archives for 6.8, 6.11, and 6.12. If you cannot upgrade immediately, validate or reject unreasonably large XML input prior to parsing.
Two additional security notices accompanied this advisory: CVE-2026-111487, an out-of-bounds write in the Qt3D assimp scene import plugin, and CVE-2026-107457, a memory corruption issue in the Qt MQTT QMqttClient class.