Technical impact
Specially crafted CBOR input passed to QCborValue::fromCbor() in Qt Core can cause an out-of-bounds read, which may crash the application and could expose information. This vulnerability, categorized as CWE‑125, allows an attacker to read memory beyond the bounds of a CBOR buffer, potentially revealing sensitive data. While the read is not intended to modify memory, the resulting crash or information leak could impact functionality or confidentiality.
Affected Systems
The Qt framework (Qt, QtBase) is affected. No specific vendor version information is provided, so all releases that include QCborValue::fromCbor() that have not been patched may be susceptible.
Risk and Exploitability
The CVSS score of 2 indicates low severity. EPSS is not available and the vulnerability is not listed in KEV, suggesting a low likelihood of widespread exploitation. The attack vector is inferred to be a local or remote attacker feeding malformed CBOR input to an application that uses QCborValue::fromCbor(), which could lead to information disclosure and, in some cases, application crashes. No current exploit has been reported, and the impact remains limited to potential leakage of memory contents or denial of service from a crash.
