Live › vulnerability › CVE-2026-103653
The Qt CoAP module reads past the end of a buffer when it parses a malformed CoAP message in QCoapInternalReply::createFromFrame(). An attacker who sends such a message can crash an application using Qt CoAP or make it act on incorrect data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 08:19 UTC. All times on this page are UTC.
Applications built with the Qt CoAP module that receive CoAP messages, including over a network, are exposed to a crash or incorrect data. Applications that do not use Qt CoAP are not affected. The sources do not give affected version ranges.
No product ranges from the sources yet.
Qt6CoAP or Qt5CoAP in build files or dependencies).qmake --version or qt-cmake --version; the affected and fixed version ranges are unknown from the sources.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An out-of-bounds read vulnerability in the Qt CoAP message parsing (QCoapInternalReply::createFromFrame()) of the Qt CoAP module. Processing a malformed CoAP message can cause an application using Qt CoAP to crash (loss of availability) or to continue operating on incorrect data (potential loss of integrity).
This page as .md · .json · in your agent: get_signal("CVE-2026-103653")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.