CVE-2026-94370

MediumCVSS 6.5

Published: 14/10/2026(UTC)Updated: 15/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

25th percentile - higher than 25% of all known CVEs

Summary

A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion to the internal string type copies the pointer without taking ownership. Two objects then release the same memory, producing a double free, an invalid free, or a use-after-free.

Risk Assessment

The risk includes system crashes, potential arbitrary code execution, or data integrity compromise in applications using Qt for MCUs.

Recommendation

Update Qt for MCUs to a patched version and avoid passing std::string to Qul::String without proper ownership management.

Other vulnerabilities in Qt for MCUs

CVE-2026-19395Medium
In Qt for MCUs, a Text element that displays styled text halts the device if an <img> tag in the text contains an attribute with an empty value. The text parser passes the empty value to an internal check that only accepts non-empty values; the check fails and reports an error, and the default error handler halts the device.

Original NVD description (English source)

A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion to the internal string type copies the pointer without taking ownership of it. Two objects then release the same memory, producing a double free, an invalid free, or a use-after-free.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS