The Qt CoAP module contains an out‑of‑bounds read in QCoapInternalReply::createFromFrame() that can be triggered by a malformed CoAP message. If an attacker supplies such a message the application may crash, leading to service unavailability, or the application may continue operating on corrupted data, resulting in data integrity loss. This weakness is classified as CWE‑125.

All systems that deploy the Qt CoAP module of the Qt framework are susceptible. No specific Qt or Qt CoAP version ranges are listed, so all current releases should be reviewed for the presence of this bug.

The CVSS base score is 6.7, indicating moderate severity. The EPSS score is not available and the vulnerability is not listed in CISA KEV. Based on the description, it is inferred that an attacker can send crafted CoAP requests to any application that uses Qt CoAP, potentially from a remote network, to trigger the out‑of‑bounds read and cause a crash or integrity compromise. No additional mitigations are described in the advisory, so the vulnerability is considered exploitable under realistic conditions.