CVE-2026-105923CWE-190CWE-476

CVE-2026-105923

published October 21, 2026

CVSS
4.0
EPSS
0%
Percentile
1.7
In the wild
Unconfirmed
What it is

A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in VectorImage QML Type.

The record
Technical detail
CVSS
4.0 · NONE
CVSS v4.0
4.0 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/RE:L/U:Green
EPSS
0.00120 · 1.7th percentile
Weaknesses
CWE-190 · Integer Overflow or Wraparound; CWE-476 · NULL Pointer Dereference
Published
2026-10-21T14:16Z
References (2)
https://codereview.qt-project.org/c/qt%2Fqtbase/+/762279 · a59d8014-47c4-4630-ab43-e1b13cbe58e3https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products · a59d8014-47c4-4630-ab43-e1b13cbe58e3
EPSS history
Timeline
  • 22 OCT 03:28Z
    EPSS moved — → 0%
    epss
  • 21 OCT 09:21Z
    Null-pointer dereference in QTriangulator reachable through VectorImage
    cvelistv5
  • 21 OCT 09:21Z
    Null-pointer dereference in QTriangulator reachable through VectorImage
    cvelistv5