---
id: "CVE-2026-100140"
kind: "vulnerability"
aliases: ["CVE-2026-100140"]
title: "Qt: integer overflow in XML parsing may crash or misbehave"
severity: "low"
cvss: 1.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["c++", "package", "qt"]
not_affected_if: []
published_at: "2026-11-02T12:16:58+00:00"
first_seen_at: "2026-11-02T12:23:05+00:00"
updated_at: "2026-11-02T12:24:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100140", "first_seen_at": "2026-11-02T12:23:05+00:00"}]
---

# Qt: integer overflow in XML parsing may crash or misbehave

Qt's XML parsing code in the Qt5Compat module (QXmlSimpleReader) has an integer overflow. The sources do not say what an attacker can get beyond a low CVSS score of 1.9.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-02T12:23:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-100140

## From the sources

An integer overflow vulnerability in the Qt XML parsing (Qt5Compat / QXmlSimpleReader) functionality of Qt.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_