Qt Group PlcCVE-2026-13326

qt: out-of-bounds read

CVE-2026-13326 · Published Sep 11, 2026 · updated Sep 18, 2026

Medium6.9

Fix: upgrade to 6.8.9 or later (2 fixed versions below)

An out-of-bounds read in Qt NFC's language code length parsing allows a physically proximate attacker to cause a denial of service or limited memory disclosure via a crafted NFC tag.

Affected versions

Package	Affected	Fixed in
qt Product	>= 5.2.0, < 6.8.9	6.8.9
	>= 6.9.0, < 6.11.2	6.11.2

Details and references

CVSS 4.0: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-125, CWE-191

More Qt Group Plc advisories

All Qt Group Plc

Medium 4.5Sep 24

qt: authentication bypassCVE-2026-79680fixed in 6.8.9 +1 Low 2.3Sep 23

qt: denial of serviceCVE-2026-78253no fix yet Low 0.6Sep 23

qt: out-of-bounds readCVE-2026-79616no fix yet Medium 4.6Sep 16

qt: out-of-bounds readCVE-2026-76151fixed in 6.8.9 +1 High 7.1Sep 16

qt: denial of serviceCVE-2026-19248no fix yet High 7.1Sep 8

qt: denial of serviceCVE-2026-11573fixed in 6.8.2