CVE-2026-101201CWE-125CWE-190

CVE-2026-101201

published October 20, 2026

CVSS
4.3
EPSS
0%
Percentile
2.2
In the wild
Unconfirmed
What it is

A malformed header in the binary file fed to QBinaryJson::fromBinaryData() can cause undefined behaviour because of out-of-bounds read.

The record
Technical detail
CVSS
4.3 · NONE
CVSS v4.0
4.3 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/R:U/RE:L/U:Amber
EPSS
0.00127 · 2.2th percentile
Weaknesses
CWE-125 · Out-of-bounds Read; CWE-190 · Integer Overflow or Wraparound
Published
2026-10-20T13:17Z
References (3)
https://codereview.qt-project.org/c/qt/qt5compat/+/758925 · a59d8014-47c4-4630-ab43-e1b13cbe58e3https://codereview.qt-project.org/c/qt/qt5compat/+/759230 · a59d8014-47c4-4630-ab43-e1b13cbe58e3https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-101201 · a59d8014-47c4-4630-ab43-e1b13cbe58e3
EPSS history
Timeline
  • 21 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 20 OCT 08:20Z
    QBinaryJson::fromBinaryData() integer overflow leading to OOB read
    cvelistv5
  • 20 OCT 08:20Z
    QBinaryJson::fromBinaryData() integer overflow leading to OOB read
    cvelistv5