Qt Patches High-Severity Out-of-Bounds Read in Qt CoAP Module
Qt has released updates to address a high-severity out-of-bounds read vulnerability in its CoAP module affecting versions from 5.13.0 through 6.11.2.
Qt disclosed CVE-2026-103653, an out-of-bounds read in the Qt CoAP module located in QCoapInternalReply::createFromFrame(). Published on November 3, 2026, the vulnerability carries a CVSS 4.0 score of 6.7 and an Amber urgency rating, involving network-based attacks with low complexity and no required privileges or user interaction.
The flaw affects Qt releases from Qt 5.13.0 through Qt 6.8.8 and Qt 6.9.0 through Qt 6.11.2, leading to either an application crash or operation on incorrect data.
While no workaround fixes the flaw, network filtering to accept CoAP traffic only from trusted peers can reduce exposure. Fixed releases include Qt 6.8.9 LTS, Qt 6.11.3, and Qt 6.12.0 or later. Alternatively, developers can apply patches for the dev, Qt 6.11, and Qt 6.8 LTS branches, which include .diff files named CVE-2026-103653-qtcoap-6.11-0001.diff and -0002.diff for 6.11, and CVE-2026-103653-qtcoap-6.8-0001.diff and -0002.diff for 6.8.
Because older Qt 5 deployments are affected and the advisory lists no Qt 5 patches or fixed Qt 5 releases, developers running those older versions must determine how to proceed or migrate to a fixed Qt 6 release. Two additional security notices accompanied this advisory: CVE-2026-100140, an integer overflow in Qt5Compat XML parsing, and CVE-2026-111487, an out-of-bounds write in the Qt3D assimp scene import plugin.