CVE-2026-94370: Memory corruption (double free / use-after-free) vulnerability in core string handling impacts Qt for MCUs
A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion to the internal string type copies the pointer without taking ownership of it. Two objects then release the same memory, producing a double free, an invalid free, or a use-after-free.
Affected Software
Event History
Frequently Asked Questions
What application code pattern is exposed?
Applications are exposed when they pass text to Qt Quick Ultralite through the public Qul::String interface and the text is stored in a std::string. The conversion can copy the pointer into the internal string representation without transferring ownership.
What must occur for the memory corruption to be triggered?
The affected conversion must result in two objects releasing the same underlying memory. This can lead to a double free, invalid free, or use-after-free.
Which deployments should be investigated first?
Investigate Qt for MCUs applications that use Qt Quick Ultralite and construct or pass Qul::String values from std::string-backed text. The provided information does not identify affected versions, default configurations, or a workaround.