Vulnerability record/PUBLISHED/Published Nov 3, 2026 07:35:45 UTC

CVE-2026-103653

An out-of-bounds read vulnerability in the Qt CoAP message parsing (QCoapInternalReply::createFromFrame()) of the Qt CoAP module. Processing a malformed CoAP message can cause an application using Qt CoAP to crash (loss of availability) or to continue operating on incorrect data (potential loss of integrity).

Base score6.7/ 10

SeverityMediumCVSS 4.0

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityMedium

Attack vectorNetworkAV

Attack complexityLowAC

Attack requirementsNoneAT

Privileges requiredNonePR

User interactionNoneUI

Vulnerable system confidentialityNoneVC

Vulnerable system integrityLowVI

Vulnerable system availabilityHighVA

Subsequent system confidentialityNoneSC

Subsequent system integrityNoneSI

Subsequent system availabilityNoneSA

Exploit maturityUnprovenE

AutomatableYesAU

RecoveryUserR

Response effortLowRE

Provider urgencyAmberU

CVSS vector stringCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/AU:Y/R:U/RE:L/U:Amber

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering AuthorityQt

Last updatedNov 3, 2026 07:35:45 UTC

PublishedNov 3, 2026 07:35:45 UTC

ReservedOct 1, 2026 07:37:03 UTC