high · CVSS v3 7.5 · CVSS v4 6

CVE-2026-107457

A memory corruption flaw exists in Qt's QMqttClient class when handling certain MQTT 5 connection settings. The bug can corrupt heap memory,

Overview

A memory corruption flaw exists in Qt's QMqttClient class when handling certain MQTT 5 connection settings. The bug can corrupt heap memory, leading to application crashes. It affects any application using the Qt MQTT module with MQTT 5 enabled.

Description

A memory corruption vulnerability in the QMqttClient class of the Qt MQTT module. Under certain MQTT 5 connection settings between client and server, QMqttClient may corrupt memory, which can cause the application to crash.

Impact

The vulnerability compromises confidentiality, integrity, and availability of the affected application. An attacker could trigger a crash, causing denial of service, and potentially use the memory corruption to execute arbitrary code if combined with other flaws. Defenders should consider the risk when deploying Qt MQTT clients in production environments.

Remediation

Upgrade to the latest Qt release that includes the fix for CVE-2026-107457. If an upgrade is not immediately possible, disable MQTT 5 support or fall back to MQTT 3.1.1. Verify that the application does not use the vulnerable QMqttClient constructor paths. Apply any vendor patches and test for stability.

Risk context

With a CVSS v3 score of 7.5 and high severity, the flaw warrants prompt attention. Although EPSS is not available, the potential for application crashes makes it a moderate to high urgency issue for deployments relying on MQTT 5.

Affected products

  • Qt
  • Qt MQTT module
  • QMqttClient

Scores

Severity
high
CVSS v2
6.4
CVSS v3
7.5
CVSS v4
6
EPSS
—

memory-corruption Qt MQTT5 client crash high-severity

← All CVEs

Related CVEs

high

CVE-2026-117518

CVE-2026-117518 affects the @fastify/reply-from plugin, allowing unauthenticated requests to bypass proxy path restrictions via backslash dot-segments. This can expose unintended upstream endpoints. The vulnerability is high severity.

View analysis

high

CVE-2026-120347

A vulnerability was determined in dayrui XunRuiCMS up to 4.7.4. Affected is the function View of the file dayrui/Fcms/Core/View.php of the component Member Module. Executing a manipulation of the argument catid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 9b6ea0cf9c6e8cdc9a5260c38b95da5fed4c4231. The affected component should be upgraded.

View analysis

high

CVE-2026-120348

A high‑severity code injection flaw exists in the Email Template Rendering component of Dayrui XunRuiCMS up to version 4.7.4. The flaw allows remote attackers to inject arbitrary code via the _get_tpl_content function. It can be exploited without authentication, making it a significant risk for sites running affected versions.

View analysis

high

CVE-2026-120313

Network-AI before 5.15.5 contains a path traversal vulnerability in InputSanitizer.sanitizePath() that allows attackers to escape the base directory using sibling-directory paths. Attackers can supply paths whose directory name shares a string prefix with the base, bypassing the unanchored startsWith check to read, list, or write files outside the sandbox.

View analysis