The QMqttClient class in Qt’s MQTT module contains a memory corruption flaw that is triggered by specific MQTT 5 connection settings. When the vulnerability is exercised, the client may corrupt heap or stack memory, causing the application to crash. The weakness is classified as CWE-129 and CWE-787, indicating improper conversion and out‑of‑bounds writes.

Any Qt distribution that includes the QMqttClient class in the qtmqtt module may be affected. The data does not specify a version range, so all Qt releases containing this class and used with MQTT 5 connection handling are potentially vulnerable.

The CVSS score of 2.3 signifies a low severity. EPSS is not available and the vulnerability is not listed in CISA KEV. Exploitation requires a client that connects to a broker using the specific MQTT 5 settings that trigger the flaw, so the attack vector is limited to client‑side interactions with a misconfigured broker. No evidence of remote code execution or wide availability is provided, and the impact is limited to application crashes.