Executive brief
Qt's NFC (Near Field Communication) module contains a vulnerability in how it parses language codes from NFC tags. An attacker with a specially crafted NFC tag can trigger an out-of-bounds memory read, causing the application to crash or potentially leak a small amount of memory. This affects any application using Qt's NFC functionality to read tags.
Technical details
An out-of-bounds read vulnerability exists in Qt NFC's language code length parsing logic. The vulnerability is triggered when processing a malformed NFC tag with an incorrectly specified language code length field. The attack requires physical proximity to the NFC reader and a crafted NFC tag. A successful exploit can cause a denial of service (crash) or limited information disclosure through memory disclosure. A patch is available in the Qt project's code review system (codereview.qt-project.org).
Affected products
- Qt Qt NFC <UNKNOWN>
Timeline
- 2026-09-11: disclosed