CVE-2026-105923: Null-pointer dereference in QTriangulator reachable through VectorImage
Published Oct 21, 2026
·Updated
A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in VectorImage QML Type.
Affected Software
1 affected component
Qt QT
Event History
Oct 21, 2026
CVE Published
via MITRE·09:21 AM
Data Sourced
via MITRE·09:21 AM
DescriptionWeakness
Frequently Asked Questions
1
Which applications are exposed to this issue?
Applications that use the VectorImage QML type and process SVG content from an untrusted source are exposed to the described attack path.
2
What does an attacker need to exploit it?
An attacker needs to provide a malicious SVG that triggers the integer overflow in the QTriangulator processing path.