Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

Qt

First CVE: Oct 18, 2006Active for: 20 yearsTotal CVEs: 67
36.2
VTI Score
Medium

Qt is a widely embedded cross-platform application development framework whose vulnerability footprint, despite a compact product portfolio, spans extensive deployments across consumer, enterprise, and embedded systems where graphical rendering and XML processing occur. The vulnerability profile concentrates in core components such as QtBase, QtSVG, QtWebKit, and XML parsing utilities, with a recurring pattern of memory-safety and input-validation weaknesses including buffer overflows, out-of-bounds writes, and integer overflow conditions characteristic of large C++ codebases handling untrusted content. A meaningful share of the vendor's disclosures reach serious severity, reflecting the role these libraries play in processing potentially adversarial graphical and structured-data inputs. Defenders should treat Qt framework updates as infrastructure-level patches affecting downstream applications rather than tracking the framework alone, since a single flaw in core utilities propagates across all dependent software; current exploitation activity and exposure counts are shown alongside this summary.

FAUCET AI Generated
67
Total CVEs
More Total CVEs than 99% of tracked vendors
0.6
Avg CVEs / Product / Year
More Avg CVEs / Product / Year than 9% of tracked vendors
6.6
Avg CVSS Score
Higher Avg CVSS Score than 42% of tracked vendors
0.0%
In CISA KEV
Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact products developed by Qt over time

Volume of CVEsAvg CVSS Base Score
First CVE
Oct 18, 2006
19 years ago
Most Recent CVE
Jul 23, 2026
1 day ago

Products(6 total)

Top CVEs

Signals from CVEs in this vendor scope (67 CVEs).

67 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2011-3193HIGH
Heap-based buffer overflow in the Lookup_MarkMarkPos function in the HarfBuzz module (harfbuzz-gpos.c), as used by Qt before 4.7.4 and Pango, allows remote attackers to cause a den
Jun 16, 20129.333NONO
CVE-2025-14576HIGH
Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick.
Apr 30, 20267.832NONO
CVE-2018-19873CRITICAL
An issue was discovered in Qt before 5.11.3. QBmpHandler has a buffer overflow via BMP data.
Dec 26, 20189.832NONO
CVE-2017-10904CRITICAL
Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors.
Dec 16, 20179.832NONO
CVE-2010-2621MEDIUM
The QSslSocketBackendPrivate::transmit function in src_network_ssl_qsslsocket_openssl.cpp in Qt 4.6.3 and earlier allows remote attackers to cause a denial of service (infinite loo
Jul 2, 20105.032NOYES
CVE-2011-3194HIGH
Buffer overflow in the TIFF reader in gui/image/qtiffhandler.cpp in Qt 4.7.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via th
Jun 16, 20129.331NONO
CVE-2018-19870HIGH
An issue was discovered in Qt before 5.11.3. A malformed GIF image causes a NULL pointer dereference in QGifHandler resulting in a segmentation fault.
Dec 26, 20188.829NONO
CVE-2023-51714CRITICAL
An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktab
Dec 24, 20239.828NONO
CVE-2018-15518HIGH
QXmlStream in Qt 5.x before 5.11.3 has a double-free or corruption during parsing of a specially crafted illegal XML document.
Dec 26, 20188.828NONO
CVE-2026-9499MEDIUM
An out-of-bounds read (buffer over-read) vulnerability exists in QTextCodec::codecForName() in Qt. When the function is called with a QByteArray that is not NUL-terminated (for exa
Jul 21, 20266.327NONO
View all 67 CVEs →

CVE Severity & Scoring

Severity distribution of CVEs that affect this vendor's products67 CVEs
54%
34%
Severity distribution among all CVEs352,231 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local13 (19.4%)
Network35 (52.2%)
Unknown17 (25.4%)
Physical0 (0.0%)
Adjacent Network2 (3.0%)
Attack Complexity
Low48 (71.6%)
High2 (3.0%)
Unknown17 (25.4%)
User Interaction
None30 (44.8%)
Unknown17 (25.4%)
Required20 (29.9%)
Privileges Required
Low3 (4.5%)
High0 (0.0%)
None47 (70.1%)
Unknown17 (25.4%)

Exploit Exposure

Signals from CVEs in this vendor scope (67 CVEs).

CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
1 CVE
1.5% of CVEs· 74th percentile

Social Chatter

An overview of all social media posts that mention a CVE ID that affects a product developed by Qt.

Media Mentions

Media articles that mention a CVE ID that affects a product developed by Qt — matched by CVE ID, not by vendor name.

Top CNAs Publishing CVEs For Qt's Products

View all 7 CNAs →

Top CWEs