A defect in Qt for MCUs core string handling causes the internal string representation to copy a pointer from a std::string without taking ownership. When an application passes text into Qt Quick Ultralite via the public Qul::String interface, the same memory block may be released twice or accessed after it has been freed, resulting in double free, invalid free, or use‑after‑free conditions. These memory‑corruption incidents can trigger application crashes, denial of service, or if an attacker can manipulate the order of deallocations, arbitrary code execution. The flaw maps to several CWEs, including CWE-1341, CWE-415, CWE-416, CWE-590, and CWE-665.

The vulnerability affects the Qt for MCUs product family. No specific version range is listed in the CNA data, so all current or future revisions that contain the flawed core string handling code are potentially impacted.

The CVSS score of 6.5 indicates a moderate severity of impact. The EPSS score of less than 1% shows a low probability of active exploitation under current conditions. The vulnerability is not listed in the CISA KEV catalogue. Based on the description, it is inferred that attackers would need to supply crafted input via the Qul::String interface, which points to a local or elevated‑privilege attack surface rather than a remote exploitation trigger. Even so, an adversary who can control the free sequence could potentially achieve malicious code execution or destabilize the MCU system.