{"affected":[{"defaultStatus":"unaffected","platforms":["64 bit"],"product":"Qt","source":"CNA: Qt","vendor":"qt","versions":[{"lessThan":"5.12.0","status":"unaffected","version":"0","versionType":"python"},{"lessThanOrEqual":"6.8.8","status":"affected","version":"5.12.0","versionType":"python"},{"lessThanOrEqual":"6.11.1","status":"affected","version":"6.9.0","versionType":"python"}]}],"cveId":"CVE-2026-107157","cwes":["CWE-125"],"description":"Specially crafted CBOR input passed to QCborValue::fromCbor() in Qt Core can cause an out-of-bounds read, which may crash the application and could expose information.","epss":{"date":"2026-11-08","percentile":0.0391,"score":0.00147},"exploits":[],"kev":null,"metrics":[{"score":2,"severity":"low","source":"CNA: Qt","vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/RE:L/U:Amber","version":"4.0"}],"modifiedAt":1794204060515,"publishedAt":1793019146628,"references":[{"source":"CNA: Qt","tags":["vendor-advisory"],"url":"https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-107157:"},{"source":"CNA: Qt","tags":["patch"],"url":"https://codereview.qt-project.org/c/qt/qtbase/+/745719"}],"remediation":[{"kind":"fix","source":"CNA: Qt","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://codereview.qt-project.org/c/qt/qtbase/+/745719"}],"revision":"1dd81a25017e055ccaf28f872b3c1616ff6a3a5598aba845abb5dd8f5c2118f5","sources":[{"modifiedAt":1794204060515,"name":"CNA: Qt","retrievedAt":1794208101085,"url":"https://www.cve.org/CVERecord?id=CVE-2026-107157"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794208141122,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107157"}],"ssvc":{"assessedAt":1793026789279,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Out-of-bounds read vulnerability in QCborValue::fromCbor() impacts Qt Framework","updatedAt":1794208141122}