CVE-2026-105923
Null-pointer dereference in QTriangulator reachable through VectorImage
4.0 Medium
CVE-2026-105923 is a medium vulnerability (CVSS 4.0) in Qt, published October 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.12%, the 1st percentile. No source names a fixed version.
- Severity
- 4.0 MediumCVSS 4.0, CVE List
- Exploit chance
- 0.12%EPSS, 1st percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in VectorImage QML Type.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Active
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
0.12%Down 0.1 points since Oct 21, 2026
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
qt6-baseDebian:12 | All versions, plus listed versions 6.10.2+dfsg-16.10.2+dfsg-106.10.2+dfsg-10+hurd.16.10.2+dfsg-116.10.2+dfsg-12 Show 45 moreShow less6.10.2+dfsg-136.10.2+dfsg-146.10.2+dfsg-156.10.2+dfsg-166.10.2+dfsg-26.10.2+dfsg-36.10.2+dfsg-46.10.2+dfsg-56.10.2+dfsg-66.10.2+dfsg-76.10.2+dfsg-7+hurd.16.10.2+dfsg-86.10.2+dfsg-96.11.2+dfsg-16.11.2+dfsg-26.11.2+dfsg-36.11.2+dfsg-46.11.2+dfsg-56.11.2+dfsg-5+sparc646.11.2+dfsg-66.11.2+dfsg-76.4.2+dfsg-106.4.2+dfsg-116.4.2+dfsg-11~bpo11+16.4.2+dfsg-126.4.2+dfsg-136.4.2+dfsg-146.4.2+dfsg-156.4.2+dfsg-166.4.2+dfsg-176.4.2+dfsg-186.4.2+dfsg-18+loong646.4.2+dfsg-196.4.2+dfsg-206.4.2+dfsg-216.4.2+dfsg-21.16.6.0+dfsg-16.6.0+dfsg-26.6.0+dfsg-36.6.0+dfsg-46.6.0+dfsg-56.6.0+dfsg-66.6.1+dfsg-16.6.1+dfsg-26.6.1+dfsg-3 | None known |
qt6-baseDebian:13 | All versions, plus listed versions 6.10.2+dfsg-16.10.2+dfsg-106.10.2+dfsg-10+hurd.16.10.2+dfsg-116.10.2+dfsg-12 Show 35 moreShow less6.10.2+dfsg-136.10.2+dfsg-146.10.2+dfsg-156.10.2+dfsg-166.10.2+dfsg-26.10.2+dfsg-36.10.2+dfsg-46.10.2+dfsg-56.10.2+dfsg-66.10.2+dfsg-76.10.2+dfsg-7+hurd.16.10.2+dfsg-86.10.2+dfsg-96.11.2+dfsg-16.11.2+dfsg-26.11.2+dfsg-36.11.2+dfsg-46.11.2+dfsg-56.11.2+dfsg-5+sparc646.11.2+dfsg-66.11.2+dfsg-76.8.2+dfsg-106.8.2+dfsg-10.16.8.2+dfsg-96.8.2+dfsg-9+deb13u16.8.2+dfsg-9+deb13u26.9.1+dfsg-16.9.1+dfsg-26.9.1+dfsg-36.9.1+dfsg-46.9.1+dfsg-56.9.2+dfsg-16.9.2+dfsg-26.9.2+dfsg-36.9.2+dfsg-4 | None known |
qt6-baseDebian:14 | All versions, plus listed versions 6.10.2+dfsg-16.10.2+dfsg-106.10.2+dfsg-10+hurd.16.10.2+dfsg-116.10.2+dfsg-12 Show 33 moreShow less6.10.2+dfsg-136.10.2+dfsg-146.10.2+dfsg-156.10.2+dfsg-166.10.2+dfsg-26.10.2+dfsg-36.10.2+dfsg-46.10.2+dfsg-56.10.2+dfsg-66.10.2+dfsg-76.10.2+dfsg-7+hurd.16.10.2+dfsg-86.10.2+dfsg-96.11.2+dfsg-16.11.2+dfsg-26.11.2+dfsg-36.11.2+dfsg-46.11.2+dfsg-56.11.2+dfsg-5+sparc646.11.2+dfsg-66.11.2+dfsg-76.8.2+dfsg-106.8.2+dfsg-10.16.8.2+dfsg-96.9.1+dfsg-16.9.1+dfsg-26.9.1+dfsg-36.9.1+dfsg-46.9.1+dfsg-56.9.2+dfsg-16.9.2+dfsg-26.9.2+dfsg-36.9.2+dfsg-4 | None known |
qtbase-opensource-srcDebian:12 | All versions, plus listed versions 5.15.10+dfsg-15.15.10+dfsg-25.15.10+dfsg-35.15.10+dfsg-45.15.10+dfsg-5 Show 45 moreShow less5.15.10+dfsg-65.15.10+dfsg-75.15.10+dfsg-7.15.15.10+dfsg-7.25.15.11+dfsg-15.15.12+dfsg-15.15.12+dfsg-25.15.12+dfsg-35.15.13+dfsg-15.15.13+dfsg-25.15.13+dfsg-35.15.13+dfsg-45.15.14+dfsg-15.15.15+dfsg-15.15.15+dfsg-25.15.15+dfsg-35.15.15+dfsg-45.15.15+dfsg-55.15.15+dfsg-65.15.16+dfsg-15.15.16+dfsg-25.15.17+dfsg-15.15.17+dfsg-25.15.17+dfsg-35.15.17+dfsg-45.15.17+dfsg-55.15.17+dfsg-65.15.17+dfsg-75.15.17+dfsg-85.15.18+dfsg-15.15.18+dfsg-25.15.19+dfsg-15.15.19+dfsg-25.15.19+dfsg-35.15.19+dfsg-45.15.19+dfsg-55.15.19+dfsg-65.15.8+dfsg-115.15.8+dfsg-11+deb12u15.15.8+dfsg-11+deb12u25.15.8+dfsg-11+deb12u35.15.8+dfsg-125.15.8+dfsg-135.15.9+dfsg-15.15.9+dfsg-2 | None known |
qtbase-opensource-srcDebian:13 | All versions, plus listed versions 5.15.15+dfsg-65.15.15+dfsg-6+deb13u15.15.16+dfsg-15.15.16+dfsg-25.15.17+dfsg-1 Show 15 moreShow less5.15.17+dfsg-25.15.17+dfsg-35.15.17+dfsg-45.15.17+dfsg-55.15.17+dfsg-65.15.17+dfsg-75.15.17+dfsg-85.15.18+dfsg-15.15.18+dfsg-25.15.19+dfsg-15.15.19+dfsg-25.15.19+dfsg-35.15.19+dfsg-45.15.19+dfsg-55.15.19+dfsg-6 | None known |
qtbase-opensource-srcDebian:14 | All versions, plus listed versions 5.15.15+dfsg-65.15.16+dfsg-15.15.16+dfsg-25.15.17+dfsg-15.15.17+dfsg-2 Show 14 moreShow less5.15.17+dfsg-35.15.17+dfsg-45.15.17+dfsg-55.15.17+dfsg-65.15.17+dfsg-75.15.17+dfsg-85.15.18+dfsg-15.15.18+dfsg-25.15.19+dfsg-15.15.19+dfsg-25.15.19+dfsg-35.15.19+dfsg-45.15.19+dfsg-55.15.19+dfsg-6 | None known |
qtbase-opensource-src-glesDebian:12 | All versions, plus listed versions 5.15.10+dfsg-15.15.10+dfsg-25.15.10+dfsg-35.15.10+dfsg-45.15.10+dfsg-5 Show 13 moreShow less5.15.10+dfsg-65.15.12+dfsg-15.15.13+dfsg-15.15.13+dfsg-25.15.15+dfsg-15.15.15+dfsg-25.15.17+dfsg-15.15.17+dfsg-25.15.18+dfsg-15.15.19+dfsg-15.15.19+dfsg-25.15.8+dfsg-35.15.9+dfsg-1 | None known |
qtbase-opensource-src-glesDebian:13 | All versions, plus listed versions 5.15.15+dfsg-25.15.17+dfsg-15.15.17+dfsg-25.15.18+dfsg-15.15.19+dfsg-15.15.19+dfsg-2 | None known |
qtbase-opensource-src-glesDebian:14 | All versions, plus listed versions 5.15.15+dfsg-25.15.17+dfsg-15.15.17+dfsg-25.15.18+dfsg-15.15.19+dfsg-15.15.19+dfsg-2 | None known |
qt6Red Hat:hummingbird:1 From an advisory covering 10 CVEs | before 0:6.12.0-1.hum1 | 0:6.12.0-1.hum1 |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
qt6-filesystemRed Hat:hummingbird:1 From an advisory covering 10 CVEs | before 0:6.12.0-1.hum1 | 0:6.12.0-1.hum1 |
qt6-rpm-macrosRed Hat:hummingbird:1 From an advisory covering 10 CVEs | before 0:6.12.0-1.hum1 | 0:6.12.0-1.hum1 |
qt6-srpm-macrosRed Hat:hummingbird:1 From an advisory covering 10 CVEs | before 0:6.12.0-1.hum1 | 0:6.12.0-1.hum1 |
qtbase-opensource-src-glesUbuntu:16.04:LTS | All versions, plus listed versions 5.4.2+dfsg-2ubuntu95.5.1+dfsg-6ubuntu15.5.1+dfsg-10ubuntu15.5.1+dfsg-13ubuntu15.5.1+dfsg-13ubuntu2 Show 9 moreShow less5.5.1+dfsg-13ubuntu35.5.1+dfsg-14ubuntu15.5.1+dfsg-14ubuntu25.5.1+dfsg-14ubuntu35.5.1+dfsg-15ubuntu15.5.1+dfsg-16ubuntu15.5.1+dfsg-16ubuntu45.5.1+dfsg-16ubuntu55.5.1+dfsg-16ubuntu6 | None known |
qtbase-opensource-src-glesUbuntu:20.04:LTS | All versions, plus listed versions 5.12.4+dfsg-1build15.12.5+dfsg-15.12.5+dfsg-25.12.8+dfsg-0ubuntu1 | None known |
qtbase-opensource-src-glesUbuntu:22.04:LTS | All versions, plus listed versions 5.15.2+dfsg-45.15.2+dfsg-55.15.3+dfsg-1 | None known |
qtbase-opensource-src-glesUbuntu:24.04:LTS | All versions, plus listed versions 5.15.10+dfsg-25.15.10+dfsg-35.15.12+dfsg-15.15.12+dfsg-1ubuntu15.15.12+dfsg-1ubuntu25.15.13+dfsg-1 | None known |
qtbase-opensource-src-glesUbuntu:26.10 | All versions, plus listed versions 5.15.18+dfsg-15.15.19+dfsg-2 | None known |
qtbase-opensource-src-glesUbuntu:26.04:LTS | All versions, plus listed versions 5.15.17+dfsg-15.15.17+dfsg-25.15.18+dfsg-1 | None known |
What each source reports
CVE List Score used
Null-pointer dereference in QTriangulator reachable through VectorImage
A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in VectorImage QML Type.
- Record
CVE-2026-105923- CVSS 4.0
- 4.0 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/RE:L/U:Green - Weakness
- CWE-476, CWE-190
- Updated
- 2026-11-02
EUVDEUVD-2026-107159
A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in VectorImage QML Type.
- Record
EUVD-2026-107159- CVSS 4.0
- 4.0 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/RE:L/U:Green - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-fqj5-mj9g-cmjj
A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference...
A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in VectorImage QML Type.
- Record
GHSA-fqj5-mj9g-cmjj- CVSS 4.0
- 4.0 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:X/RE:L/U:Green - Weakness
- CWE-190
- Updated
- 2026-11-02
NVD
A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in VectorImage QML Type.
- Record
CVE-2026-105923- CVSS 4.0
- 4.0 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:X/RE:L/U:Green - Weakness
- CWE-190, CWE-476
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-105923
A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in VectorImage QML Type.
- Record
DEBIAN-CVE-2026-105923- CVSS 4.0
- 4.0 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:X/RE:L/U:Green - Updated
- 2026-11-02
OSVRHSA-2026:89193
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:89193- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-13
OSVUBUNTU-CVE-2026-105923
A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in VectorImage QML Type.
- Record
UBUNTU-CVE-2026-105923- CVSS 4.0
- 4.0 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/RE:L/U:Green - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, facts, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products
codereview.qt-project.org/c/qt%2Fqtbase/+/762279
nvd.nist.gov/vuln/detail/CVE-2026-105923
github.com/advisories/GHSA-fqj5-mj9g-cmjj
security-tracker.debian.org/tracker/CVE-2026-105923
access.redhat.com/errata/RHSA-2026:89193
Show 62 moreShow less
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_89193.json
bugzilla.redhat.com/show_bug.cgi?id=2559539
cve.org/CVERecord?id=CVE-2026-95620
ubuntu.com/security/CVE-2026-105923
advisory.echohq.com/cve/cve-2026-105923
This page doesn't list everything
Left out here: 44 versions. The JSON record has them.