The QBinaryJson::fromBinaryData() function in Qt can be triggered by a malformed binary file header, which causes an integer overflow (CWE‑190) that propagates to an out‑of‑bounds read (CWE‑125). This undefined behaviour permits an attacker to read memory beyond the supplied buffer, potentially revealing sensitive data to the application and the user.

All Qt installations that include the Qt, Qt5Compat, or QtBase libraries are affected. The vulnerability exists in any version that exposes the QBinaryJson parsing routine; no specific version ranges are listed in the CNA data.

The CVSS score of 4.3 indicates moderate impact, while the EPSS of fewer than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector involves an attacker supplying a crafted binary file—via file uploads, network data streams, or other input mechanisms—to a Qt application in order to trigger the invalid header parse. The malicious consequence is limited to memory disclosure and does not provide direct code execution or other higher‑level privileges.