A flaw in the String.arg() method of Qt for MCUs causes the size of the buffer to be calculated incorrectly when formatting Latin‑1 strings. This allows the function to read past the end of a buffer, exposing arbitrary memory contents. The vulnerability is classified as an out‑of‑bounds read (CWE‑125) and incorrect buffer size calculation (CWE‑131). If an attacker supplies a crafted Latin‑1 string, the resulting read can leak information or trigger a crash.

The affected product is Qt for MCUs. No specific version information is provided in the current advisory. Users running any current version of Qt for MCUs that employs String.arg() with Latin‑1 text are potentially impacted.

The nominal CVSS score of 8.8 indicates a high severity. The EPSS score is not available, so the current exploitation probability cannot be quantified, and the issue is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is local application code that constructs user‑controlled strings for formatting. An attacker may trigger the read by supplying a specially crafted input to the affected function, potentially leaking memory contents or causing a crash.