CVE-2026-105923
No fix known EPSS <1%CVSS 4.0
A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in VectorImage QML Type.
Products: qt
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | qt6-base | no fix |
| Debian 12 | qtbase-opensource-src | no fix |
| Debian 12 | qtbase-opensource-src-gles | no fix |
| Debian 13 | qt6-base | no fix |
| Debian 13 | qtbase-opensource-src | no fix |
| Debian 13 | qtbase-opensource-src-gles | no fix |
| Debian 14 | qt6-base | no fix |
| Debian 14 | qtbase-opensource-src | no fix |
| Debian 14 | qtbase-opensource-src-gles | no fix |