The vulnerability is an out‑of‑bounds read in QCborValue::fromCbor() within the Qt Framework, classified as CWE‑125. It allows an attacker to read memory beyond the bounds of a CBOR buffer, potentially exposing sensitive information. The bug does not corrupt memory or crash the application, but it can leak data that may be useful to an attacker.

The Qt framework (Qt, QtBase) is affected. No specific vendor version information is provided, so all releases that include QCborValue::fromCbor() that have not been patched may be susceptible.

The CVSS score of 2 indicates low severity. EPSS is not available and the vulnerability is not listed in KEV, suggesting a low likelihood of widespread exploitation. The attack vector is inferred to be a local or remote attacker feeding malformed CBOR input to an application that uses QCborValue::fromCbor(), which could lead to information disclosure. No current exploit has been reported, and the impact remains limited to potential leakage of memory contents.