---
id: "CVE-2026-107157"
kind: "vulnerability"
aliases: ["CVE-2026-107157"]
title: "Qt Framework: CBOR parser reads past buffer bounds in fromCbor()"
severity: "low"
cvss: 2.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["c++", "desktop", "package", "qt"]
not_affected_if: []
published_at: "2026-10-26T14:16:23+00:00"
first_seen_at: "2026-10-26T14:30:36+00:00"
updated_at: "2026-10-26T14:32:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107157", "first_seen_at": "2026-10-26T14:30:36+00:00"}]
---

# Qt Framework: CBOR parser reads past buffer bounds in fromCbor()

QCborValue::fromCbor() in the Qt Framework can read memory beyond the end of its input buffer when parsing CBOR data. An attacker who can supply CBOR input to an affected Qt application could leak nearby memory contents.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-26T14:30:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107157

## From the sources

Out-of-bounds read vulnerability in QCborValue::fromCbor() impacts Qt Framework.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_