Description
A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion to the internal string type copies the pointer without taking ownership of it. Two objects then release the same memory, producing a double free, an invalid free, or a use-after-free.
Published: 2026-10-14
Score: 6.5 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 06:00:00 +0000

Type Values Removed Values Added
Description A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion to the internal string type copies the pointer without taking ownership of it. Two objects then release the same memory, producing a double free, an invalid free, or a use-after-free.
Title Memory corruption (double free / use-after-free) vulnerability in core string handling impacts Qt for MCUs
First Time appeared Qt
Qt qt For Mcus
Weaknesses CWE-415
CWE-416
CWE-590
CWE-665
CPEs cpe:2.3:a:qt:qt_for_mcus:*:*:*:*:*:*:*:*
Vendors & Products Qt
Qt qt For Mcus
References
Metrics cvssV4_0

{'score': 6.5, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:H/E:U/S:P/AU:N/R:U/V:D/RE:M'}

Subscriptions

Qt Qt For Mcus
cve-icon MITRE

Status: PUBLISHED

Assigner: Qt

Published:

Updated: 2026-10-14T05:43:27.953Z

Reserved: 2026-09-21T11:36:04.324Z

Link: CVE-2026-94370

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-14T06:17:07.070

Modified: 2026-10-14T06:17:07.070

Link: CVE-2026-94370

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses