Vulnerability record/PUBLISHED/Published Oct 26, 2026 12:52:26 UTC

CVE-2026-107157

Specially crafted CBOR input passed to QCborValue::fromCbor() in Qt Core can cause an out-of-bounds read, which may crash the application and could expose information.

Base score2.0/ 10

SeverityLowCVSS 4.0

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityLow

Attack vectorLocalAV

Attack complexityHighAC

Attack requirementsNoneAT

Privileges requiredNonePR

User interactionPassiveUI

Vulnerable system confidentialityHighVC

Vulnerable system integrityNoneVI

Vulnerable system availabilityHighVA

Subsequent system confidentialityNoneSC

Subsequent system integrityNoneSI

Subsequent system availabilityNoneSA

Exploit maturityUnprovenE

Response effortLowRE

Provider urgencyAmberU

CVSS vector stringCVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/RE:L/U:Amber

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering AuthorityQt

Last updatedNov 9, 2026 06:01:00 UTC

PublishedOct 26, 2026 12:52:26 UTC

ReservedOct 7, 2026 10:50:59 UTC