Qt MQTT Client Memory Corruption Bug Patched in Versions 6.8.9 and 6.11.3
The Qt Company has released patches for a low-severity memory corruption vulnerability affecting MQTT 5 connections in various Qt 5 and 6 releases.
CVE-2026-107457 is a Low severity memory corruption bug in the QMqttClient class of the Qt MQTT module carrying a CVSS 4.0 score of 2.3. Published by The Qt Company on October 30, 2026, the vulnerability triggers under certain unspecified MQTT 5 connection settings and can crash applications.
The CVSS vector rates availability impact as high while confidentiality and integrity impacts are listed as none. Affected software ranges from Qt 5.12.0 through Qt 6.8.8, and from Qt 6.11.0 through Qt 6.11.2. Because the advisory lists no mitigation, developers cannot rely on configuration workarounds.
The fix is available in Qt 6.8.9, Qt 6.11.3, Qt 6.12.0, and subsequent releases. For teams unable to upgrade immediately, Qt published patches for the dev branch, Qt 6.11, and Qt 6.8 on its code review system, alongside downloadable diff files for the 6.11 and 6.8 lines. The advisory provides no patch for the Qt 5.x range.
Alongside this notice, Qt published CVE-2026-105924, a NULL pointer dereference affecting QCborValue to JSON conversion, and noted the availability of Qt 6.12 LTS.