CVE-2026-94370
Qt_for_MCUs: Memory corruption (double free / use-after-free) vulnerability in core string handling impacts Qt for MCUs
qt Qt_for_MCUs
CVSS
6.5MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.33%Chance of exploitation activity in the next 30 days, higher than 25% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 2.12.3Qt_for_MCUsCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion to the internal string type copies the pointer without taking ownership of it. Two objects then release the same memory, producing a double free, an invalid free, or a use-after-free.
Text from CVE List
Affected versions 1
- Qt_for_MCUsaffected: 2.12.1 before 2.12.3CVE List