Security feed

25 October 2026

advisoryMediumOfficial CVE List25 Oct 2026

Memory corruption (double free / use-after-free) vulnerability in core string handling impacts Qt for MCUs

A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion to the internal string type copies the pointer without taking ownership of it. Two objects then release the same memory, producing a double free, an invalid free, or a use-after-free.

Announced 14 Oct 2026

Qt_for_MCUs CVE-2026-94370

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-94370

Qt_for_MCUs

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-94370
Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event: #22200 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 05:58:00 GMT
Publisher date: Wed, 14 Oct 2026 05:43:27 GMT

Read the original announcement

24 October 2026

advisoryMediumOfficial CVE List24 Oct 2026

An empty attribute value in styled text triggers a parser error that halts the device.

In Qt for MCUs, a Text element that displays styled text halts the device if an tag in the text contains an attribute with an empty value. The text parser passes the empty value to an internal check that only accepts non-empty values. The check fails and reports an error, and the default error handler halts the device.

Announced 5 Oct 2026

Qt for MCUs CVE-2026-19395

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-19395

Qt for MCUs

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-19395
Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event: #8572 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 23:03:07 GMT
Publisher date: Mon, 05 Oct 2026 09:18:28 GMT

Read the original announcement

advisoryHighOfficial CVE List24 Oct 2026

Out-of-bounds read vulnerability in string formatting impacts Qt for MCUs

Strings optimized for Latin-1 displaying Latin-1 characters cause incorrect String.arg() formatting by an incorrect buffer size calculation, causing out-of-bounds reading.

Announced 29 Sept 2026

Qt for MCUs CVE-2026-95509

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95509

Qt for MCUs

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95509
Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event: #3496 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:36:10 GMT
Publisher date: Tue, 29 Sep 2026 10:40:12 GMT

Read the original announcement