Vulnerability in Qt for MCUs

[ Description ]Official description

Strings optimized for Latin-1 displaying Latin-1 characters cause incorrect String.arg() formatting by an incorrect buffer size calculation, causing out-of-bounds reading.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund29 Sep 2026WID-SEC-2026-3653

  QT for MCUs: Multiple vulnerabilities allow denial of service and data manipulation Translated from German

  CVE-2026-95509CVE-2026-19395

[ References ]References

• wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products