Zero Radar
← feed
HighVulnerabilityupdated 27 Oct 2026, 16:35 UTC

Qt framework: several flaws let remote attackers crash apps or access data

Qt is a software toolkit used to build many desktop and embedded programs. Attackers over the network may be able to crash affected programs, and some flaws may also expose or change data.

Official source
SeverityHighVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official sourceBacked by an official source

What happened

Multiple vulnerabilities in the Qt framework, including a denial-of-service flaw in the QXmlStream XML parser, can be triggered remotely by an unauthenticated attacker.

Why it is dangerous: A remote attacker can make affected Qt applications stop working, and the higher-severity advisory also reports possible disclosure or manipulation of data.

Are you affected?

You are affected if you run software built on Qt versions covered by the BSI advisories, particularly applications that parse XML via QXmlStream or process untrusted input.

Qt (affected versions not specified in the provided material); Qt Core QXmlStream parser

What to do

  1. Identify all software on your systems that uses the Qt framework
  2. Check the vendor of each Qt-based application for updates and install them as soon as available
  3. Apply the Qt security updates referenced in the CERT-Bund/BSI advisories once the affected versions are confirmed

Timeline

  1. 23 Oct 2026, 10:25 UTC
    Publicly disclosed
  2. 23 Oct 2026, 10:25 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  3. 23 Oct 2026, 10:50 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  4. 25 Oct 2026, 15:20 UTC
    Picked up by Zero Radar
  5. 26 Oct 2026, 07:54 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  6. 26 Oct 2026, 07:55 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  7. 26 Oct 2026, 12:34 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  8. 27 Oct 2026, 11:33 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  9. 27 Oct 2026, 11:33 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  10. 27 Oct 2026, 12:51 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  11. 27 Oct 2026, 16:35 UTC
    Severity raised to high

Sources 8 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
ZR-a38a3656 · ZR-3b8259cf · ZR-66a258d2 · ZR-df35538d · ZR-7e0fcef8 · ZR-b0e0eb8b · ZR-ca99fade · ZR-31479f26
Disclosed
23 Oct 2026, 10:25 UTC
On Zero Radar
25 Oct 2026, 15:20 UTC (2 days after disclosure)
Last change
27 Oct 2026, 16:35 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Qt framework: several flaws let remote attackers crash apps or access data · Zero Radar