CVE-2026-94370 Details
Description
A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion to the internal string type copies the pointer without taking ownership of it. Two objects then release the same memory, producing a double free, an invalid free, or a use-after-free.
A heap memory corruption vulnerability has been identified in Qt for MCUs versions 2.12.1 prior to 2.12.2. The issue arises in the core string handling when text is passed into Qt Quick Ultralite via the public Qul::String interface, and the text is held in a std::string. The vulnerability occurs because the conversion to the internal string type copies the pointer without taking ownership, allowing two objects to release the same memory. This can result in a double free, an invalid free, or a use-after-free condition, all of which are considered undefined behavior and may lead to application crashes or memory corruption.
Users can upgrade to Qt for MCUs version 2.12.3 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-94370: | TQtC |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-415 | Double Free | TQtC |
| CWE-416 | Use After Free | TQtC |
| CWE-590 | Free of Memory not on the Heap | TQtC |
| CWE-665 | Improper Initialization | TQtC |
Affected Products
| Product | Versions |
|---|---|
| Qt for MCUs | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | TQtC |