qt-group-plcCVE-2026-13326

An out-of-bounds read in Qt NFC's language code length parsing allows a physically proximate attacker to cause a denial of service or limited memory disclosure via a crafted NFC tag.

Medium6.9CVE-2026-13326 · Published Sep 11, 2026 · updated Sep 18, 2026

Affected versions

Package	Affected	Fixed in
qt Vendor	>= 5.2.0, < 6.8.9	6.8.9
	>= 6.9.0, < 6.11.2	6.11.2

Details and references

CVSS 4.0: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity from: no source yet
Weakness: CWE-125, CWE-191

More qt-group-plc advisories

All

Date	Advisory	Severity	Fixed in
Sep 8	Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). CVE-2026-11573High7.1fixed in qt 6.8.2	High7.1	qt 6.8.2
Sep 16	QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input. CVE-2026-19248High7.1no fix yet	High7.1	No fix yet
Sep 16	Out-of-bounds read (buffer over-read) in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Group Qt 6.0.0 through 6.8.8, and 6.9.0 through 6.11. CVE-2026-76151Medium4.6fixed in qt 6.8.9, qt 6.11.2	Medium4.6	qt 6.8.9, qt 6.11.2
Sep 23	Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path. CVE-2026-79616Low0.6no fix yet	Low0.6	No fix yet
Sep 23	Uncontrolled recursion in QXmlStreamReader::readElementText() in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted XML document. CVE-2026-78253Low2.3no fix yet	Low2.3	No fix yet
Sep 24	Authentication bypass vulnerability in the password authentication mechanism of the Qt VNC Server module. CVE-2026-79680Medium4.5fixed in qt 6.8.9, qt 6.11.3	Medium4.5	qt 6.8.9, qt 6.11.3

Affected versions

More qt-group-plc advisories

Critical advisories by email