# Qt vulnerabilities Source: https://junglewise.ai/threats/vendors/qt Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/qt.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 24 vulnerabilities in Qt: 5 in the last 7 days and 24 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-97845, was published on 12 November 2026. 15 vulnerabilities in the last four weeks, up 275% on the four before (4). 3 technologies have a page of their own. ## Counts - Last 7 days: 5 - Last 30 days: 19 - Last 90 days: 24 - All time: 24 (0 critical, 0 exploited in the wild) ## About Qt Qt is a cross-platform application development framework for building graphical user interfaces and applications. ## Latest Qt vulnerabilities - [CVE-2026-97845: Qt QXmlSimpleReader uncontrolled recursion in XML parsing](https://junglewise.ai/threats/cve-2026-97845-an-uncontrolled-recursion-vulnerability-has-been-discovered-in) (info, published 12 Nov 2026) - [CVE-2026-114369: Qt WebSockets resource exhaustion](https://junglewise.ai/threats/cve-2026-114369-resource-exhaustion-vulnerability-in-the-qt-framework-qwebsocket) (info, published 12 Nov 2026) - [CVE-2026-82292: Qt Framework NULL pointer dereference in QDomDocument XML parsing](https://junglewise.ai/threats/cve-2026-82292-a-null-pointer-dereference-vulnerability-in-the-qt-framework) (info, published 12 Nov 2026) - [CVE-2026-116337: Qt Framework uncontrolled resource consumption in HTTP response handling](https://junglewise.ai/threats/cve-2026-116337-uncontrolled-resource-consumption-vulnerability-in-the-qt) (info, published 9 Nov 2026) - [CVE-2026-114366: Qt Framework QWebSocket authentication information disclosure](https://junglewise.ai/threats/cve-2026-114366-an-information-disclosure-vulnerability-in-the-qt-framework) (info, published 6 Nov 2026) - [CVE-2026-107479: Qt Framework integer truncation in QTextCodec conversion](https://junglewise.ai/threats/cve-2026-107479-an-integer-truncation-vulnerability-in-the-qtextcodec-conversion) (info, published 4 Nov 2026) - [CVE-2026-110944: Qt HTTP Server QHttpServer resource exhaustion](https://junglewise.ai/threats/cve-2026-110944-resource-exhaustion-vulnerability-in-the-http-request-handling) (info, published 4 Nov 2026) - [CVE-2026-103653: Qt CoAP out-of-bounds read in message parsing](https://junglewise.ai/threats/cve-2026-103653-an-out-of-bounds-read-vulnerability-in-the-qt-coap-message) (info, published 3 Nov 2026) - [CVE-2026-100140: Qt integer overflow in XML parsing](https://junglewise.ai/threats/cve-2026-100140-an-integer-overflow-vulnerability-in-the-qt-xml-parsing) (info, published 2 Nov 2026) - [CVE-2026-107457: Qt QMqttClient memory corruption in MQTT 5](https://junglewise.ai/threats/cve-2026-107457-a-memory-corruption-vulnerability-in-the-qmqttclient-class-of) (info, published 2 Nov 2026) - [CVE-2026-111487: Qt Framework out-of-bounds write in Qt3D assimp plugin](https://junglewise.ai/threats/cve-2026-111487-an-out-of-bounds-write-vulnerability-in-the-qt-framework-assimp) (info, published 30 Oct 2026) - [CVE-2026-105924: Qt Core NULL pointer dereference in CBOR to JSON conversion](https://junglewise.ai/threats/cve-2026-105924-a-null-pointer-dereference-vulnerability-in-the-qt-qcborvalue-to) (info, published 30 Oct 2026) - [CVE-2026-107590: Qt out-of-bounds write in QTextCodec iconv encoding](https://junglewise.ai/threats/cve-2026-107590-an-out-of-bounds-write-vulnerability-in-the-qt-qtextcodec-iconv) (info, published 27 Oct 2026) - [CVE-2026-107472: Qt out-of-bounds read in QTextCodec TSCII encoding](https://junglewise.ai/threats/cve-2026-107472-an-out-of-bounds-read-vulnerability-in-the-qtextcodec-tscii) (info, published 27 Oct 2026) - [CVE-2026-107157: Qt Framework out-of-bounds read in QCborValue::fromCbor()](https://junglewise.ai/threats/cve-2026-107157-out-of-bounds-read-vulnerability-in-qcborvalue-fromcbor-impacts) (info, published 26 Oct 2026) - [CVE-2026-95620: Qt use-after-free in QNetworkAccessManager HTTP/2 support](https://junglewise.ai/threats/cve-2026-95620-a-use-after-free-vulnerability-in-the-qt-qnetworkaccessmanager) (info, published 23 Oct 2026) - [CVE-2026-16762: Qt QXmlStreamReader denial of service via crafted XML](https://junglewise.ai/threats/cve-2026-16762-an-attacker-able-to-supply-a-crafted-xml-document-to-an) (info, published 23 Oct 2026) - [CVE-2026-105923: Qt VectorImage integer overflow and null-pointer dereference](https://junglewise.ai/threats/cve-2026-105923-a-malicious-svg-can-trigger-an-integer-overflow-which-in-turn) (info, published 21 Oct 2026) - [CVE-2026-101201: Qt binary JSON out-of-bounds read in QBinaryJson::fromBinaryData](https://junglewise.ai/threats/cve-2026-101201-a-malformed-header-in-the-binary-file-fed-to-qbinaryjson) (info, published 20 Oct 2026) - [CVE-2026-19395: Qt for MCUs Text element denial of service with malformed img tag](https://junglewise.ai/threats/cve-2026-19395-in-qt-for-mcus-a-text-element-that-displays-styled-text-halts-the) (info, published 5 Oct 2026) - [CVE-2026-95509: Qt QString buffer overflow in String.arg() with Latin-1 encoding](https://junglewise.ai/threats/cve-2026-95509-strings-optimized-for-latin-1-displaying-latin-1-characters-cause) (info, published 29 Sep 2026) - [CVE-2026-79680: Qt VNC Server authentication bypass in password mechanism](https://junglewise.ai/threats/cve-2026-79680-authentication-bypass-vulnerability-in-the-password) (info, published 24 Sep 2026) - [CVE-2026-79616: Qt Quick out-of-bounds read in SVG path parsing](https://junglewise.ai/threats/cve-2026-79616-out-of-bounds-read-while-parsing-untrusted-svg-path-strings-in-qt) (info, published 23 Sep 2026) - [CVE-2026-13326: Qt NFC out-of-bounds read in language code parsing](https://junglewise.ai/threats/cve-2026-13326-qt-nfc-out-of-bounds-read-in-language-code-parsing) (info, published 11 Sep 2026) ## Most severe Qt vulnerabilities - [CVE-2026-19395: Qt for MCUs Text element denial of service with malformed img tag](https://junglewise.ai/threats/cve-2026-19395-in-qt-for-mcus-a-text-element-that-displays-styled-text-halts-the) (info, published 5 Oct 2026) - [CVE-2026-79680: Qt VNC Server authentication bypass in password mechanism](https://junglewise.ai/threats/cve-2026-79680-authentication-bypass-vulnerability-in-the-password) (info, published 24 Sep 2026) - [CVE-2026-13326: Qt NFC out-of-bounds read in language code parsing](https://junglewise.ai/threats/cve-2026-13326-qt-nfc-out-of-bounds-read-in-language-code-parsing) (info, published 11 Sep 2026) - [CVE-2026-79616: Qt Quick out-of-bounds read in SVG path parsing](https://junglewise.ai/threats/cve-2026-79616-out-of-bounds-read-while-parsing-untrusted-svg-path-strings-in-qt) (info, published 23 Sep 2026) - [CVE-2026-97845: Qt QXmlSimpleReader uncontrolled recursion in XML parsing](https://junglewise.ai/threats/cve-2026-97845-an-uncontrolled-recursion-vulnerability-has-been-discovered-in) (info, published 12 Nov 2026) - [CVE-2026-114369: Qt WebSockets resource exhaustion](https://junglewise.ai/threats/cve-2026-114369-resource-exhaustion-vulnerability-in-the-qt-framework-qwebsocket) (info, published 12 Nov 2026) - [CVE-2026-82292: Qt Framework NULL pointer dereference in QDomDocument XML parsing](https://junglewise.ai/threats/cve-2026-82292-a-null-pointer-dereference-vulnerability-in-the-qt-framework) (info, published 12 Nov 2026) - [CVE-2026-116337: Qt Framework uncontrolled resource consumption in HTTP response handling](https://junglewise.ai/threats/cve-2026-116337-uncontrolled-resource-consumption-vulnerability-in-the-qt) (info, published 9 Nov 2026) - [CVE-2026-114366: Qt Framework QWebSocket authentication information disclosure](https://junglewise.ai/threats/cve-2026-114366-an-information-disclosure-vulnerability-in-the-qt-framework) (info, published 6 Nov 2026) - [CVE-2026-107479: Qt Framework integer truncation in QTextCodec conversion](https://junglewise.ai/threats/cve-2026-107479-an-integer-truncation-vulnerability-in-the-qtextcodec-conversion) (info, published 4 Nov 2026) ## Vulnerabilities per week 15 vulnerabilities in the last four weeks, up 275% on the four before (4). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 1 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 2 | 0 | 0 | | 28 Sep 2026 | 1 | 0 | 0 | | 5 Oct 2026 | 1 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 4 | 0 | 0 | | 26 Oct 2026 | 5 | 0 | 0 | | 2 Nov 2026 | 6 | 0 | 0 | | 9 Nov 2026 | 4 | 0 | 0 | ## Qt technologies - [Qt Framework](https://junglewise.ai/threats/technologies/qt-qt-framework): 7 vulnerabilities - [Qt](https://junglewise.ai/threats/technologies/qt-qt): 5 vulnerabilities - [Qt 5](https://junglewise.ai/threats/technologies/qt-5): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Qt vulnerabilities", https://junglewise.ai/threats/vendors/qt, 13 November 2026.