Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| qt | Qt_for_MCUs | unaffected |
|
No data.
No data.
No data available yet.
No solution or workaround provided in the CVE record.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 14 Oct 2026 06:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion to the internal string type copies the pointer without taking ownership of it. Two objects then release the same memory, producing a double free, an invalid free, or a use-after-free. | |
| Title | Memory corruption (double free / use-after-free) vulnerability in core string handling impacts Qt for MCUs | |
| First Time appeared |
Qt
Qt qt For Mcus |
|
| Weaknesses | CWE-415 CWE-416 CWE-590 CWE-665 |
|
| CPEs | cpe:2.3:a:qt:qt_for_mcus:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Qt
Qt qt For Mcus |
|
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: Qt
Published:
Updated: 2026-10-14T05:43:27.953Z
Reserved: 2026-09-21T11:36:04.324Z
Link: CVE-2026-94370
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-14T06:17:07.070
Modified: 2026-10-14T06:17:07.070
Link: CVE-2026-94370
Redhat
No data.
OpenCVE Enrichment
No data.