Executive brief
qTox is a peer-to-peer messaging and calling application. A flaw in how qTox deserializes settings files allows a local attacker to cause the application to crash or consume excessive memory, disrupting the user's ability to communicate and access their messages.
Technical details
The vulnerability exists in the SettingsSerializer readStream() function within src/persistence/settingsserializer.cpp. The function fails to properly validate input data when reading from a QDataStream, leading to unbounded memory allocation and potential integer overflow conditions. A local attacker can craft a malicious settings file that triggers these flaws, causing qTox to allocate excessive memory or crash when parsing the file. This attack requires local file system access to place or modify the settings file that qTox reads during startup or normal operation.
Affected products
- TokTok qTox v1.18.4 and earlier versions
Timeline
- 2026-08-26: disclosed
- 2026-08-26: advisory: CVE-2026-51106 assigned